21 lines
622 B
JavaScript
21 lines
622 B
JavaScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { nativePreviewToken } from "../src/media-access.ts";
|
|
|
|
test("native preview accepts only opaque grants, never paths or destinations", () => {
|
|
const token = "a123456789abcdef0123456789abcdef";
|
|
assert.equal(nativePreviewToken(token), token);
|
|
for (const value of [
|
|
"C:/Users/karl/photo.jpg",
|
|
"/home/user/video.mp4",
|
|
"https://example.com/media",
|
|
"../" + token,
|
|
token + "?file=secret",
|
|
"%2f" + token,
|
|
"",
|
|
token.toUpperCase(),
|
|
]) {
|
|
assert.throws(() => nativePreviewToken(value), /preview access/);
|
|
}
|
|
});
|