@jrpool/kilotest 51.1.0 → 55.0.0

package/test/setup.ts

@@ -12,3 +12,8 @@
 for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
   process.env[key] = '';
 }
+// Allow internal targets by default, so that tests submitting an ordinary
+// https://example.com/... URL for testing do not depend on real DNS/network access
+// to pass the resolution check that isAllowedTarget performs. A test of that check
+// itself sets this env var back to unset (or false) around the specific call being tested.
+process.env.ALLOW_INTERNAL_TARGETS = 'true';

package/util.test.ts

@@ -7,6 +7,7 @@
 
 import {test, before, after} from 'node:test';
 import assert from 'node:assert/strict';
+import net from 'node:net';
 import path from 'node:path';
 import fs from 'node:fs/promises';
 
@@ -25,12 +26,14 @@ import {
   checkLength,
   createLock,
   dbPath,
+  describeMax,
   getAgoDays,
   getAgoString,
   getCountString,
   getDateString,
   getDateTime,
   getEngineNamesString,
+  getEnvMax,
   getIssue,
   errorMessage,
   getJSON,
@@ -51,6 +54,9 @@ import {
   getWeightName,
   hiddenReportsPath,
   htmlSafe,
+  isAllowedRedirectTarget,
+  isAllowedReport,
+  isAllowedTarget,
   isJobID,
   isReportAvailable,
   isTimeStamp,
@@ -265,6 +271,46 @@ test('getDateTime returns null for an invalid time stamp', () => {
   assert.equal(getDateTime('invalid'), null);
 });
 
+test('getEnvMax returns the default when the variable is unset', () => {
+  delete process.env.TEST_ENV_MAX_VAR;
+  assert.equal(getEnvMax('TEST_ENV_MAX_VAR', 20), 20);
+});
+
+test('getEnvMax returns the default when the variable is empty', () => {
+  process.env.TEST_ENV_MAX_VAR = '';
+  assert.equal(getEnvMax('TEST_ENV_MAX_VAR', 20), 20);
+  delete process.env.TEST_ENV_MAX_VAR;
+});
+
+test('getEnvMax returns the configured value when it is a positive integer', () => {
+  process.env.TEST_ENV_MAX_VAR = '50';
+  assert.equal(getEnvMax('TEST_ENV_MAX_VAR', 20), 50);
+  delete process.env.TEST_ENV_MAX_VAR;
+});
+
+test('getEnvMax returns the default when the variable is not an integer', () => {
+  process.env.TEST_ENV_MAX_VAR = 'not-a-number';
+  assert.equal(getEnvMax('TEST_ENV_MAX_VAR', 20), 20);
+  delete process.env.TEST_ENV_MAX_VAR;
+});
+
+test('getEnvMax returns 0 when the variable is explicitly 0, meaning no limit', () => {
+  process.env.TEST_ENV_MAX_VAR = '0';
+  assert.equal(getEnvMax('TEST_ENV_MAX_VAR', 20), 0);
+  delete process.env.TEST_ENV_MAX_VAR;
+});
+
+test('getEnvMax returns the default when the variable is negative', () => {
+  process.env.TEST_ENV_MAX_VAR = '-5';
+  assert.equal(getEnvMax('TEST_ENV_MAX_VAR', 20), 20);
+  delete process.env.TEST_ENV_MAX_VAR;
+});
+
+test('describeMax returns "no limit" for a cap of 0 and the number otherwise', () => {
+  assert.equal(describeMax(0), 'no limit');
+  assert.equal(describeMax(20), '20');
+});
+
 test('getIssue returns an issue ID for a known engine and rule', () => {
   const issueID = getIssue('axe', 'link-name');
   assert.ok(typeof issueID === 'string' || issueID === null);
@@ -366,6 +412,332 @@ test('isURL returns false for an invalid URL', () => {
   assert.equal(isURL('not-a-url'), false);
 });
 
+// A fake resolver, so isAllowedTarget tests need no real DNS/network access.
+const fakeLookup = (address: string) => async () => [{address, family: net.isIP(address)}];
+
+// isAllowedTarget and isAllowedReport branch on ALLOW_INTERNAL_TARGETS, which other test
+// files (sharing this process) set to "true" for their own unrelated tests, so every test
+// below sets the env var itself, rather than relying on it being unset by default, and
+// restores whatever value preceded it.
+let savedAllowInternalTargets: string | undefined;
+
+before(() => {
+  savedAllowInternalTargets = process.env.ALLOW_INTERNAL_TARGETS;
+});
+
+after(() => {
+  if (savedAllowInternalTargets === undefined) {
+    delete process.env.ALLOW_INTERNAL_TARGETS;
+  }
+  else {
+    process.env.ALLOW_INTERNAL_TARGETS = savedAllowInternalTargets;
+  }
+});
+
+test('isAllowedTarget returns true for a URL resolving to a public address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('93.184.216.34')), true);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a loopback address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('127.0.0.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a private address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('10.0.0.5')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a 172.16/12 private address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('172.20.0.5')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a carrier-grade NAT address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('100.70.0.5')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a link-local/cloud-metadata address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('169.254.169.254')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an IPv6 loopback address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('::1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an IPv6 unspecified address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('::')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an IPv4-mapped private IPv6 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('::ffff:10.0.0.5')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an IPv6 unique-local address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('fd12:3456:789a:1::1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an IPv6 link-local address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('fe80::1')), false);
+});
+
+test('isAllowedTarget returns true for a URL resolving to a public IPv6 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('2606:2800:220:1:248:1893:25c8:1946')), true);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a TEST-NET-1 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('192.0.2.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a TEST-NET-2 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('198.51.100.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a TEST-NET-3 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('203.0.113.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a benchmarking (198.18/15) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('198.18.0.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a reserved 240/4 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('240.0.0.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to the broadcast address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('255.255.255.255')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a multicast address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('224.0.0.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a deprecated IPv6 site-local address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('fec0::1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an IPv6 multicast address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('ff02::1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a 6to4 (2002::/16) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('2002::1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a Teredo (2001::/32) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('2001::1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an NAT64 (64:ff9b::/96) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('64:ff9b::10.0.0.5')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an address family net.isIP does not recognize', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', async () => [{address: 'not-an-ip', family: 0}]), false);
+});
+
+test('isAllowedTarget returns false when the DNS lookup rejects', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  const lookup = async () => { throw new Error('lookup failed'); };
+  assert.equal(await isAllowedTarget('https://nonexistent.invalid/page', lookup), false);
+});
+
+test('isAllowedTarget returns false for a URL whose literal host is a private IP', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://192.168.1.1/page'), false);
+});
+
+test('isAllowedTarget returns true for a URL whose literal host is a public IP', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://93.184.216.34/page'), true);
+});
+
+test('isAllowedTarget returns false for a syntactically invalid URL', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('not-a-url'), false);
+});
+
+test('isAllowedTarget returns true for a private-address target when ALLOW_INTERNAL_TARGETS is true', async () => {
+  process.env.ALLOW_INTERNAL_TARGETS = 'true';
+  assert.equal(await isAllowedTarget('https://192.168.1.1/page'), true);
+});
+
+// A fake fetch that returns a response whose url reflects any redirect,
+// so isAllowedRedirectTarget tests need no real network access.
+const fakeFetch = (finalURL: string) => async () => ({url: finalURL}) as Response;
+
+test('isAllowedRedirectTarget returns true when the final URL resolves to a public address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://example.com/page'), fakeLookup('93.184.216.34')),
+    true
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a private address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://10.0.0.5/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when the fetch throws', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  const fetchImpl = async () => { throw new Error('fetch failed'); };
+  assert.equal(await isAllowedRedirectTarget('https://example.com/page', fetchImpl), false);
+});
+
+test('isAllowedRedirectTarget returns true for any URL when ALLOW_INTERNAL_TARGETS is true, without fetching', async () => {
+  process.env.ALLOW_INTERNAL_TARGETS = 'true';
+  const fetchImpl = async () => { throw new Error('fetch should not be called'); };
+  assert.equal(await isAllowedRedirectTarget('https://192.168.1.1/page', fetchImpl), true);
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a TEST-NET-1 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://192.0.2.1/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a TEST-NET-2 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://198.51.100.1/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a TEST-NET-3 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://203.0.113.1/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a benchmarking (198.18/15) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://198.18.0.1/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a reserved 240/4 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://240.0.0.1/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to the broadcast address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://255.255.255.255/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a multicast address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://224.0.0.1/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a deprecated IPv6 site-local address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://[fec0::1]/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a 6to4 (2002::/16) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://[2002::1]/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedRedirectTarget returns false when a redirect leads to a Teredo (2001::/32) address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(
+    await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://[2001::1]/page'), fakeLookup('93.184.216.34')),
+    false
+  );
+});
+
+test('isAllowedReport returns true when every act has a public actualURL', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  const report = {
+    target: {what: 'Example', url: 'https://example.com/page'},
+    acts: [
+      {type: 'test', actualURL: 'https://example.com/page'},
+      {type: 'test', actualURL: 'https://example.com/page2'}
+    ]
+  };
+  assert.equal(await isAllowedReport(report, fakeLookup('93.184.216.34')), true);
+});
+
+test('isAllowedReport returns false when any act has a disallowed actualURL', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  const report = {
+    target: {what: 'Example', url: 'https://example.com/page'},
+    acts: [
+      {type: 'test', actualURL: 'https://example.com/page'},
+      {type: 'test', actualURL: 'https://internal.example.net/page'}
+    ]
+  };
+  let callCount = 0;
+  const lookup = async (hostname: string) => {
+    callCount++;
+    return hostname === 'internal.example.net'
+      ? [{address: '10.0.0.5', family: 4}]
+      : [{address: '93.184.216.34', family: 4}];
+  };
+  assert.equal(await isAllowedReport(report, lookup), false);
+  assert.ok(callCount > 0);
+});
+
+test('isAllowedReport falls back to the report target URL when an act has no actualURL', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  const report = {
+    target: {what: 'Example', url: 'https://example.com/page'},
+    acts: [{type: 'test'}]
+  };
+  assert.equal(await isAllowedReport(report, fakeLookup('93.184.216.34')), true);
+});
+
 test('isValidAuthCode returns true when the code matches AUTH_CODE', () => {
   const saved = process.env.AUTH_CODE;
   process.env.AUTH_CODE = 'secret-code';
@@ -524,6 +896,63 @@ test('processTestRequest returns a retest error when a report already exists for
   assert.equal(result, 'retest');
 });
 
+test('processTestRequest returns a queueFull error once the pending-request queue is full', {timeout: 500}, async () => {
+  // Fill testRequests.json with 20 pending requests, all for the same URL, so the total
+  // pending count (summed across all URLs' request arrays) reaches the cap directly,
+  // without needing 20 distinct URLs.
+  const filler = Array.from({length: 20}, (_, i) => ({
+    timeStamp: getNowStamp(), description: `Filler Page ${i}`, reason: 'because filler'
+  }));
+  await fs.writeFile(testRequestsPath(), getJSON({'https://example.com/filler': filler}));
+  // A further, distinct request is rejected as queueFull.
+  const {result} = await processTestRequest(
+    'because accessibility', {description: 'One Too Many Page', url: 'https://example.com/one-too-many'}
+  );
+  assert.equal(result, 'queueFull');
+  // Clean up testRequests.json.
+  await fs.writeFile(testRequestsPath(), '{}\n');
+});
+
+test('processTestRequest honors TEST_REQUEST_QUEUE_MAX when the cap is reached below the default', {timeout: 500}, async () => {
+  // With the cap lowered to 2, a single pending request already fills the queue.
+  process.env.TEST_REQUEST_QUEUE_MAX = '2';
+  try {
+    await fs.writeFile(testRequestsPath(), getJSON({
+      'https://example.com/filler': [
+        {timeStamp: getNowStamp(), description: 'Filler Page A', reason: 'because filler'},
+        {timeStamp: getNowStamp(), description: 'Filler Page B', reason: 'because filler'}
+      ]
+    }));
+    const {result} = await processTestRequest(
+      'because accessibility', {description: 'One Too Many Page', url: 'https://example.com/one-too-many'}
+    );
+    assert.equal(result, 'queueFull');
+  }
+  finally {
+    delete process.env.TEST_REQUEST_QUEUE_MAX;
+    await fs.writeFile(testRequestsPath(), '{}\n');
+  }
+});
+
+test('processTestRequest never returns queueFull when TEST_REQUEST_QUEUE_MAX is 0 (no limit)', {timeout: 500}, async () => {
+  // With the cap set to 0, a queue already past the default size is still not full.
+  process.env.TEST_REQUEST_QUEUE_MAX = '0';
+  try {
+    const filler = Array.from({length: 25}, (_, i) => ({
+      timeStamp: getNowStamp(), description: `Filler Page ${i}`, reason: 'because filler'
+    }));
+    await fs.writeFile(testRequestsPath(), getJSON({'https://example.com/filler': filler}));
+    const {result} = await processTestRequest(
+      'because accessibility', {description: 'One More Page', url: 'https://example.com/one-more'}
+    );
+    assert.equal(result, 'ok');
+  }
+  finally {
+    delete process.env.TEST_REQUEST_QUEUE_MAX;
+    await fs.writeFile(testRequestsPath(), '{}\n');
+  }
+});
+
 test('annotateReportObject annotates a report object in place without reading or writing a file', async () => {
   // A report object that was never written to disk (e.g. one just received from a worker,
   // as in index.ts's worker/report handler, which annotates before the first write).