SnowLuma v2.4.2 source snapshot

packages/webui/tests/transport-security.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest';
+import {
+    allowEmptyInboundAccessToken,
+    isLoopbackHostname,
+    shouldWarnAboutInsecureRemoteAccess,
+} from '../src/lib/transport-security';
+
+describe('WebUI transport security notice', () => {
+    it.each([
+        'localhost',
+        'dashboard.localhost',
+        '127.0.0.1',
+        '127.42.1.9',
+        '[::1]',
+        '0:0:0:0:0:0:0:1',
+        '::ffff:127.0.0.1',
+    ])('recognizes %s as a loopback browser hostname', (hostname) => {
+        expect(isLoopbackHostname(hostname)).toBe(true);
+    });
+
+    it.each(['0.0.0.0', '192.168.1.20', '10.0.0.8', 'snowluma.example.com', '::ffff:192.168.1.20'])(
+        'does not treat %s as loopback',
+        (hostname) => {
+            expect(isLoopbackHostname(hostname)).toBe(false);
+        },
+    );
+
+    it('allows an empty inbound token when the bind host is loopback, even from a remote WebUI', () => {
+        expect(allowEmptyInboundAccessToken('192.168.1.20', '127.0.0.1')).toBe(true);
+        expect(allowEmptyInboundAccessToken('panel.example.com', 'localhost')).toBe(true);
+        expect(allowEmptyInboundAccessToken('192.168.1.20', '0.0.0.0')).toBe(false);
+        expect(allowEmptyInboundAccessToken('192.168.1.20', '')).toBe(false);
+    });
+
+    it('still allows an empty inbound token when the WebUI itself is opened on loopback', () => {
+        expect(allowEmptyInboundAccessToken('127.0.0.1', '0.0.0.0')).toBe(true);
+        expect(allowEmptyInboundAccessToken('localhost', undefined)).toBe(true);
+    });
+
+    it('warns only when a non-loopback page is accessed without HTTPS', () => {
+        expect(
+            shouldWarnAboutInsecureRemoteAccess({ protocol: 'http:', hostname: '192.168.1.20' }),
+        ).toBe(true);
+        expect(
+            shouldWarnAboutInsecureRemoteAccess({ protocol: 'https:', hostname: '192.168.1.20' }),
+        ).toBe(false);
+        expect(
+            shouldWarnAboutInsecureRemoteAccess({ protocol: 'http:', hostname: '127.0.0.1' }),
+        ).toBe(false);
+    });
+});