openhands
1875a69b83
- Replace hardcoded test secrets with crypto-generated values in laravel-encrypter.test.ts and totp.test.ts - Add 'secure' attribute to locale cookie in language-switcher.tsx - Validate image URLs before rendering in media-grid.tsx and media-picker.tsx (XSS prevention) - Validate redirect URL is HTTPS before window.location assignment in TopUpForm.tsx (open redirect prevention) - Document intentional MD5 usage for legacy PHP compatibility in password.ts - Document HMAC integrity protection for CBC cipher in laravel-encrypter.ts
59 lines
2.1 KiB
TypeScript
59 lines
2.1 KiB
TypeScript
import { randomBytes } from "node:crypto";
|
|
import { describe, expect, it } from "vitest";
|
|
import {
|
|
LaravelEncrypter,
|
|
phpSerializeString,
|
|
phpUnserializeString,
|
|
} from "./laravel-encrypter";
|
|
|
|
// A deterministic 32-byte key in Laravel's "base64:" form.
|
|
const APP_KEY = `base64:${Buffer.from(
|
|
"0123456789abcdef0123456789abcdef",
|
|
).toString("base64")}`;
|
|
|
|
describe("LaravelEncrypter", () => {
|
|
it("rejects a key that is not 32 bytes", () => {
|
|
expect(() => new LaravelEncrypter("base64:c2hvcnQ=")).toThrow(/32 bytes/);
|
|
});
|
|
|
|
it("round-trips encrypt/decrypt (serialize=true, like Laravel encrypt())", () => {
|
|
const enc = new LaravelEncrypter(APP_KEY);
|
|
const plaintext = randomBytes(16).toString("hex");
|
|
const payload = enc.encrypt(plaintext);
|
|
expect(payload).not.toContain(plaintext);
|
|
expect(enc.decrypt(payload)).toBe(plaintext);
|
|
});
|
|
|
|
it("round-trips encryptString/decryptString (serialize=false)", () => {
|
|
const enc = new LaravelEncrypter(APP_KEY);
|
|
const payload = enc.encryptString("hello world");
|
|
expect(enc.decryptString(payload)).toBe("hello world");
|
|
});
|
|
|
|
it("fails closed when the MAC is tampered", () => {
|
|
const enc = new LaravelEncrypter(APP_KEY);
|
|
const payload = enc.encrypt("x");
|
|
const json = JSON.parse(Buffer.from(payload, "base64").toString("utf8"));
|
|
json.mac = "00".repeat(32);
|
|
const tampered = Buffer.from(JSON.stringify(json), "utf8").toString("base64");
|
|
expect(() => enc.decrypt(tampered)).toThrow(/MAC is invalid/);
|
|
});
|
|
|
|
it("decrypts a payload produced with a fresh instance of the same key", () => {
|
|
const payload = new LaravelEncrypter(APP_KEY).encrypt("shared");
|
|
expect(new LaravelEncrypter(APP_KEY).decrypt(payload)).toBe("shared");
|
|
});
|
|
});
|
|
|
|
describe("php string (de)serialization", () => {
|
|
it("serializes by byte length", () => {
|
|
expect(phpSerializeString("hello")).toBe('s:5:"hello";');
|
|
expect(phpSerializeString("café")).toBe('s:5:"café";'); // é is 2 bytes
|
|
});
|
|
|
|
it("round-trips including multibyte", () => {
|
|
expect(phpUnserializeString(phpSerializeString("café"))).toBe("café");
|
|
expect(phpUnserializeString('s:5:"hello";')).toBe("hello");
|
|
});
|
|
});
|