补强静态发布安全边界

tests/unit/works-play-url.test.ts

@@ -0,0 +1,46 @@
+import { describe, expect, it } from 'vitest';
+import {
+  trustedWorksProjectPlayUrl,
+  trustedWorksReleasePreviewUrl,
+} from '@electron/api/works-play-url';
+
+const worksBase = new URL('https://square.nianxx.cn/');
+
+describe('Works Square playable URL security', () => {
+  it('normalizes only the exact same-origin HTTPS app path', () => {
+    expect(trustedWorksProjectPlayUrl('/apps/space-cleaner/', worksBase, 'space-cleaner'))
+      .toBe('https://square.nianxx.cn/apps/space-cleaner/');
+    expect(trustedWorksProjectPlayUrl(
+      '/apps/space%20cleaner/',
+      worksBase,
+      'space cleaner',
+    )).toBe('https://square.nianxx.cn/apps/space%20cleaner/');
+  });
+
+  it.each([
+    ['cross origin', 'https://evil.example/apps/space-cleaner/', worksBase],
+    ['HTTP', 'http://square.nianxx.cn/apps/space-cleaner/', worksBase],
+    ['userinfo', 'https://user:secret@square.nianxx.cn/apps/space-cleaner/', worksBase],
+    ['loopback base', '/apps/space-cleaner/', new URL('https://127.0.0.1:8443/')],
+    ['wrong app path', '/apps/another-app/', worksBase],
+    ['nested path', '/apps/space-cleaner/index.html', worksBase],
+    ['query string', '/apps/space-cleaner/?token=secret', worksBase],
+    ['fragment', '/apps/space-cleaner/#start', worksBase],
+    ['overlong URL', `/apps/space-cleaner/${'x'.repeat(1_100)}`, worksBase],
+  ])('rejects %s', (_case, value, base) => {
+    expect(trustedWorksProjectPlayUrl(value, base, 'space-cleaner')).toBeNull();
+  });
+
+  it('keeps signed release previews on their exact release prefix', () => {
+    expect(trustedWorksReleasePreviewUrl(
+      '/previews/release-7/signed-ticket/?signature=ok',
+      worksBase,
+      'release-7',
+    )).toBe('https://square.nianxx.cn/previews/release-7/signed-ticket/?signature=ok');
+    expect(trustedWorksReleasePreviewUrl(
+      '/previews/release-8/signed-ticket/',
+      worksBase,
+      'release-7',
+    )).toBeNull();
+  });
+});