From 368b0ff80eaf46545c7d4964c189580c2f49bcc8 Mon Sep 17 00:00:00 2001
From: Sciscito <118936755+Sciscito@users.noreply.github.com>
Date: Sat, 7 Nov 2026 18:58:10 +0100
Subject: [PATCH 1/2] test: cover validateUrl against look-alike and malformed
 hosts (#18)

Adds tests for look-alike hosts, userinfo URLs, non-http(s) schemes,
IP-literal hosts, uppercase hosts, trailing dots, a valid subdomain, and a
host added through FLUX_EXTRA_SOURCE_HOSTS.

AI-assisted: written by free models in a Kickswarm private hive, reviewed
by a person.
---
 test/server.test.mjs | 96 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)

diff --git a/test/server.test.mjs b/test/server.test.mjs
index e7f8859..690e15d 100644
--- a/test/server.test.mjs
+++ b/test/server.test.mjs
@@ -45,3 +45,99 @@ test("rejects unsupported formats and arbitrary extractor arguments", () => {
     assert.throws(() => optionsFor(o));
   assert.equal(optionsFor({ language: "en-US" }).language, "en-US");
 });
+
+test("validateUrl rejects look-alike hosts and userinfo", () => {
+  for (const u of [
+    "https://youtube.com.evil.test/",
+    "https://evilyoutube.com/",
+    "https://notyoutube.com/",
+    "https://youtube.com@evil.test/",
+    "https://user:pass@youtube.com/",
+    "https://user@youtube.com/",
+  ]) {
+    assert.throws(() => validateUrl(u));
+  }
+  assert.equal(
+    validateUrl("https://m.youtube.com/watch?v=abc"),
+    "https://m.youtube.com/watch?v=abc",
+  );
+  assert.equal(validateUrl("https://youtu.be/abc"), "https://youtu.be/abc");
+});
+
+test("validateUrl rejects non-http(s) schemes", () => {
+  for (const u of [
+    "file:///etc/passwd",
+    "ftp://youtube.com/file",
+    "javascript:alert(1)",
+    "data:text/html,<script>",
+    "mailto:test@example.com",
+    "ws://youtube.com/",
+  ]) {
+    assert.throws(() => validateUrl(u));
+  }
+});
+
+test("validateUrl rejects IP-literal hosts", () => {
+  for (const u of [
+    "http://127.0.0.1/",
+    "http://93.184.216.34/",
+    "http://[::1]/",
+    "http://[::1]:443/",
+    "https://127.0.0.1/x",
+  ]) {
+    assert.throws(() => validateUrl(u));
+  }
+});
+
+test("validateUrl accepts uppercase hosts after URL normalisation", () => {
+  assert.equal(
+    validateUrl("HTTPS://YOUTUBE.COM/watch?v=abc"),
+    "https://youtube.com/watch?v=abc",
+  );
+  assert.equal(
+    validateUrl("HTTP://M.YOUTUBE.COM/watch"),
+    "http://m.youtube.com/watch",
+  );
+});
+
+test("validateUrl rejects hosts with a trailing dot", () => {
+  for (const u of [
+    "https://youtube.com./",
+    "https://youtube.com./watch?v=abc",
+    "https://m.youtube.com./",
+  ]) {
+    assert.throws(() => validateUrl(u));
+  }
+});
+
+test("validateUrl accepts valid subdomains and rejects domain look-alikes", () => {
+  assert.equal(validateUrl("https://m.youtube.com/"), "https://m.youtube.com/");
+  assert.equal(
+    validateUrl("https://m.youtube-nocookie.com/embed/abc"),
+    "https://m.youtube-nocookie.com/embed/abc",
+  );
+  assert.throws(() => validateUrl("https://youtube.com.evil.test/"));
+});
+
+test("FLUX_EXTRA_SOURCE_HOSTS adds allowed hosts", async () => {
+  const original = process.env.FLUX_EXTRA_SOURCE_HOSTS;
+  process.env.FLUX_EXTRA_SOURCE_HOSTS = "extra.example.test";
+  try {
+    // Fresh module instance so FLUX_EXTRA_SOURCE_HOSTS is read at module load.
+    const mod = await import("../server.mjs?extra-hosts=1");
+    const { validateUrl: validateExtra } = mod;
+    assert.equal(
+      validateExtra("https://extra.example.test/"),
+      "https://extra.example.test/",
+    );
+    assert.throws(() =>
+      validateExtra("https://extra.example.test.evil.test/"),
+    );
+  } finally {
+    if (original === undefined) {
+      delete process.env.FLUX_EXTRA_SOURCE_HOSTS;
+    } else {
+      process.env.FLUX_EXTRA_SOURCE_HOSTS = original;
+    }
+  }
+});

From f91d31ec3703146688410b857792e5f956a6f850 Mon Sep 17 00:00:00 2001
From: 10k11 <339974264+10k11@users.noreply.github.com>
Date: Sun, 8 Nov 2026 01:07:29 +0530
Subject: [PATCH 2/2] style: apply prettier

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 test/server.test.mjs | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/test/server.test.mjs b/test/server.test.mjs
index 690e15d..8d5096b 100644
--- a/test/server.test.mjs
+++ b/test/server.test.mjs
@@ -130,9 +130,7 @@ test("FLUX_EXTRA_SOURCE_HOSTS adds allowed hosts", async () => {
       validateExtra("https://extra.example.test/"),
       "https://extra.example.test/",
     );
-    assert.throws(() =>
-      validateExtra("https://extra.example.test.evil.test/"),
-    );
+    assert.throws(() => validateExtra("https://extra.example.test.evil.test/"));
   } finally {
     if (original === undefined) {
       delete process.env.FLUX_EXTRA_SOURCE_HOSTS;