Kuma/tests/settings/return-to.test.ts

import { describe, it, expect } from "vitest";
import { sanitizeReturnTo } from "@/src/modules/settings/lib/return-to";

describe("sanitizeReturnTo", () => {
  it("lässt app-interne Pfade durch", () => {
    expect(sanitizeReturnTo("/onboarding")).toBe("/onboarding");
    expect(sanitizeReturnTo("/onboarding?step=payments")).toBe("/onboarding?step=payments");
  });

  it("lehnt absolute URLs auf fremde Hosts ab", () => {
    expect(sanitizeReturnTo("https://evil.example/pwn")).toBeNull();
    expect(sanitizeReturnTo("http://evil.example")).toBeNull();
  });

  it("lehnt protokollrelative URLs ab", () => {
    // "//host" und "/\host" interpretieren Browser als fremde Domain - das wäre
    // ein offener Redirect über den Stripe-Rücksprung.
    expect(sanitizeReturnTo("//evil.example")).toBeNull();
    expect(sanitizeReturnTo("/\\evil.example")).toBeNull();
  });

  it("behandelt leere und fehlende Werte als 'kein returnTo'", () => {
    expect(sanitizeReturnTo(null)).toBeNull();
    expect(sanitizeReturnTo(undefined)).toBeNull();
    expect(sanitizeReturnTo("")).toBeNull();
  });
});