feat: add school authentication entry with guarded import

2026-10-12 23:50:52 +08:00
parent 8a98d49d12
commit ffd3920c0d
8 changed files with 717 additions and 4 deletions
@@ -0,0 +1,56 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hepan_everyday/features/school/school_navigation_policy.dart';
+
+void main() {
+  test('secure captcha frames are allowed without authorizing credential injection', () {
+    final captcha = Uri.parse('https://captcha.example.test/challenge');
+    expect(
+      SchoolNavigationPolicy.canNavigate(captcha, isMainFrame: false),
+      isTrue,
+    );
+    expect(
+      SchoolNavigationPolicy.canNavigate(captcha, isMainFrame: true),
+      isFalse,
+    );
+    expect(SchoolNavigationPolicy.canInjectCredentials(captcha), isFalse);
+  });
+  test('credentials stay on the exact school HTTPS login endpoint', () {
+    expect(
+      SchoolNavigationPolicy.canInjectCredentials(
+        Uri.parse('https://idas.uestc.edu.cn/authserver/login?service=school'),
+      ),
+      isTrue,
+    );
+    for (final value in [
+      'http://idas.uestc.edu.cn/authserver/login',
+      'https://idas.uestc.edu.cn.evil.test/authserver/login',
+      'https://user@idas.uestc.edu.cn/authserver/login',
+      'https://idas.uestc.edu.cn:444/authserver/login',
+      'https://idas.uestc.edu.cn/other',
+    ]) {
+      expect(
+        SchoolNavigationPolicy.canInjectCredentials(Uri.parse(value)),
+        isFalse,
+        reason: value,
+      );
+    }
+  });
+  test('reading is limited to the supplied timetable path', () {
+    expect(
+      SchoolNavigationPolicy.isTimetable(
+        Uri.parse('https://yjsjy.uestc.edu.cn/pyxx/pygl/xskbcx/index/1'),
+      ),
+      isTrue,
+    );
+    expect(
+      SchoolNavigationPolicy.isTimetable(
+        Uri.parse('https://yjsjy.uestc.edu.cn/pyxx/login'),
+      ),
+      isFalse,
+    );
+    expect(
+      SchoolNavigationPolicy.isSchoolPage(Uri.parse('javascript:alert(1)')),
+      isFalse,
+    );
+  });
+}