[PR #317] [MERGED] test: add unit tests for url-safety isDangerousScheme #471

New issue

Closed

opened 2026-05-06 13:08:16 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:08:16 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/317
Author: @NathanDrake2406
Created: 3/7/2026
Status: ✅ Merged
Merged: 3/7/2026
Merged by: @james-elicx

Base: main ← Head: test/url-safety-coverage

📝 Commits (1)

28e2d87 test: add unit tests for url-safety isDangerousScheme

📊 Changes

1 file changed (+183 additions, -0 deletions)

View changed files

➕ tests/url-safety.test.ts (+183 -0)

📄 Description

Summary

Adds 33 unit tests for isDangerousScheme() in shims/url-safety.ts
Tests real XSS bypass vectors: leading whitespace, zero-width characters (\u200B, \uFEFF), mixed-case schemes, whitespace between scheme and colon
Verifies safe URLs (http, https, relative paths, mailto, tel) are not false-positived
Documents that javascript\u200B: (zero-width space between scheme and colon) is not caught by the regex, but browsers also don't execute it

This file had zero test coverage despite being security-critical — it's used by Link, Form, and navigation shims to block dangerous URI schemes.

Test plan

npx vitest run tests/url-safety.test.ts — 33/33 passing
CI: Lint, Typecheck, Vitest, Playwright E2E

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/317 **Author:** [@NathanDrake2406](https://github.com/NathanDrake2406) **Created:** 3/7/2026 **Status:** ✅ Merged **Merged:** 3/7/2026 **Merged by:** [@james-elicx](https://github.com/james-elicx) **Base:** `main` ← **Head:** `test/url-safety-coverage` --- ### 📝 Commits (1) - [`28e2d87`](https://github.com/cloudflare/vinext/commit/28e2d873c4fd39579ccd517dc734041bb118df01) test: add unit tests for url-safety isDangerousScheme ### 📊 Changes **1 file changed** (+183 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `tests/url-safety.test.ts` (+183 -0) </details> ### 📄 Description ## Summary - Adds 33 unit tests for `isDangerousScheme()` in `shims/url-safety.ts` - Tests real XSS bypass vectors: leading whitespace, zero-width characters (`\u200B`, `\uFEFF`), mixed-case schemes, whitespace between scheme and colon - Verifies safe URLs (http, https, relative paths, mailto, tel) are not false-positived - Documents that `javascript\u200B:` (zero-width space between scheme and colon) is not caught by the regex, but browsers also don't execute it This file had zero test coverage despite being security-critical — it's used by Link, Form, and navigation shims to block dangerous URI schemes. ## Test plan - [x] `npx vitest run tests/url-safety.test.ts` — 33/33 passing - [x] CI: Lint, Typecheck, Vitest, Playwright E2E --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>