import 'package:flutter_test/flutter_test.dart'; import 'package:hepan_everyday/features/school/school_navigation_policy.dart'; void main() { test( 'official HTTP graduate child frames can load for same-origin DOM reading', () { expect( SchoolNavigationPolicy.canNavigate( Uri.parse('http://yjsjy.uestc.edu.cn/pyxx/pygl/xskbcx/index/1'), isMainFrame: false, ), isTrue, ); for (final value in [ 'http://evil.test/pyxx/pygl/xskbcx/index/1', 'http://yjsjy.uestc.edu.cn:81/pyxx/pygl/xskbcx/index/1', 'http://user@yjsjy.uestc.edu.cn/pyxx/pygl/xskbcx/index/1', ]) { expect( SchoolNavigationPolicy.canNavigate( Uri.parse(value), isMainFrame: false, ), isFalse, ); } }, ); test('secure captcha frames are allowed without authorizing credential injection', () { final captcha = Uri.parse('https://captcha.example.test/challenge'); expect( SchoolNavigationPolicy.canNavigate(captcha, isMainFrame: false), isTrue, ); expect( SchoolNavigationPolicy.canNavigate(captcha, isMainFrame: true), isFalse, ); expect(SchoolNavigationPolicy.canInjectCredentials(captcha), isFalse); }); test('credentials stay on the exact school HTTPS login endpoint', () { expect( SchoolNavigationPolicy.canInjectCredentials( Uri.parse('https://idas.uestc.edu.cn/authserver/login?service=school'), ), isTrue, ); for (final value in [ 'http://idas.uestc.edu.cn/authserver/login', 'https://idas.uestc.edu.cn.evil.test/authserver/login', 'https://user@idas.uestc.edu.cn/authserver/login', 'https://idas.uestc.edu.cn:444/authserver/login', 'https://idas.uestc.edu.cn/other', ]) { expect( SchoolNavigationPolicy.canInjectCredentials(Uri.parse(value)), isFalse, reason: value, ); } }); test('reading is limited to the supplied timetable path', () { expect( SchoolNavigationPolicy.isTimetable( Uri.parse('https://yjsjy.uestc.edu.cn/pyxx/pygl/xskbcx/index/1'), ), isTrue, ); expect( SchoolNavigationPolicy.isTimetable( Uri.parse('https://yjsjy.uestc.edu.cn/pyxx/login'), ), isFalse, ); expect( SchoolNavigationPolicy.isSchoolPage(Uri.parse('javascript:alert(1)')), isFalse, ); }); }