hansjone/dsh-im-ops
1
0
Fork 0
mirror of https://github.com/hansjone/dsh-im-ops.git synced 2026-10-11 15:53:17 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(weixin): trust international WeChat hosts

Browse source
This commit is contained in:
xmanrui 2026-08-26 18:46:55 +08:00
parent 50d55090b9
commit dc66366ac0
6 changed files with 14 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
test/weixin-client-api.test.mjs
View file

@ -28,11 +28,13 @@ test('client normalizes the exact redacted Host account view', () => {
assert.doesNotMatch(JSON.stringify(snapshot), /host-secret|token/);
});
test('client accepts only image data URLs and Tencent Weixin HTTPS links', () => {
test('client accepts only image data URLs and Tencent Weixin or WeChat HTTPS links', () => {
assert.match(safeQrSource('data:image/png;base64,AAAA'), /^data:image/);
assert.equal(safeQrSource('javascript:alert(1)'), undefined);
assert.equal(safeVerificationUrl('https://liteapp.weixin.qq.com/q/test'), 'https://liteapp.weixin.qq.com/q/test');
assert.equal(safeVerificationUrl('https://liteapp.wechat.com/q/test'), 'https://liteapp.wechat.com/q/test');
assert.equal(safeVerificationUrl('https://attacker.test/q/test'), undefined);
assert.equal(safeVerificationUrl('https://liteapp.wechat.com.attacker.test/q/test'), undefined);
});
test('client preserves verification-required provisioning without accepting unknown states', () => {