From df2c9205cdd336e860160efe94ccae8ca006e295 Mon Sep 17 00:00:00 2001
From: Alaister Young <a@alaisteryoung.com>
Date: Tue, 25 Jul 2023 17:39:47 +1000
Subject: [PATCH] adds tests for getReturnToPath

---
 studio/tests/unit/get-return-to-path.test.ts | 56 ++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 studio/tests/unit/get-return-to-path.test.ts

diff --git a/studio/tests/unit/get-return-to-path.test.ts b/studio/tests/unit/get-return-to-path.test.ts
new file mode 100644
index 00000000000..f7951444c17
--- /dev/null
+++ b/studio/tests/unit/get-return-to-path.test.ts
@@ -0,0 +1,56 @@
+import { getReturnToPath } from 'lib/gotrue'
+
+describe(`getReturnToPath`, () => {
+  it(`returns to /projects when no fallback is provided`, () => {
+    expect(getReturnToPath()).toBe('/projects')
+  })
+
+  it(`returns to /custom when fallback is provided`, () => {
+    expect(getReturnToPath('/custom')).toBe('/custom')
+  })
+
+  it(`returns to /custom`, () => {
+    // @ts-ignore
+    delete window.location
+    // @ts-ignore
+    window.location = { search: `?returnTo=/custom` }
+
+    expect(getReturnToPath()).toBe('/custom')
+  })
+
+  it(`returns to /custom?foo=bar`, () => {
+    // @ts-ignore
+    delete window.location
+    // @ts-ignore
+    window.location = { search: `?returnTo=/custom?foo=bar` }
+
+    expect(getReturnToPath()).toBe('/custom?foo=bar')
+  })
+
+  it(`does not return to https://google.com`, () => {
+    // @ts-ignore
+    delete window.location
+    // @ts-ignore
+    window.location = { search: `?returnTo=https://google.com` }
+
+    expect(getReturnToPath()).toBe('/projects')
+  })
+
+  it(`does not allow XSS`, () => {
+    // @ts-ignore
+    delete window.location
+    // @ts-ignore
+    window.location = { search: `?returnTo=javascript:alert(1)` }
+
+    expect(getReturnToPath()).toBe('/projects')
+  })
+
+  it(`does not allow XSS with encoded characters`, () => {
+    // @ts-ignore
+    delete window.location
+    // @ts-ignore
+    window.location = { search: `?returnTo=javascript%3Aalert%281%29` }
+
+    expect(getReturnToPath()).toBe('/projects')
+  })
+})