taler-typescript-core

commit 465c167cfbc09b79073c15d5a7c72e23d034565a
parent 3740dba58c6f0b259062da8b3a20a636fb3eefe6
Author: Florian Dold <dold@taler.net>
Date:   Tue, 21 Jul 2026 11:01:11 +0200

util: test path escaping in multi-line URL builders

Diffstat:
M
packages/taler-util/src/http-client/path-escaping.test.ts
 | 
33
+++++++++++++++++++++++++++++++++

1 file changed, 33 insertions(+), 0 deletions(-)
diff --git a/packages/taler-util/src/http-client/path-escaping.test.ts b/packages/taler-util/src/http-client/path-escaping.test.ts
@@ -99,3 +99,36 @@ test("a hostile order id cannot inject extra path segments", async (t) => {
     `injection survived: ${lib.lastUrl}`,
   );
 });
+
+test("multi-line URL builders escape their path parameters too", async (t) => {
+  const bank = new RecordingHttpLib();
+  const bankClient = new TalerCoreBankHttpClient(
+    "https://bank.example.com/api/",
+    bank,
+  );
+  await bankClient
+    .getTransactionById({ username: "../admin", token: "tok" as any }, 5 as any)
+    .catch(() => undefined);
+  assert.ok(bank.lastUrl !== undefined, "no request was made");
+  assert.ok(
+    bank.lastUrl!.startsWith("https://bank.example.com/api/accounts/"),
+    `escaped its segment: ${bank.lastUrl}`,
+  );
+
+  const merchant = new RecordingHttpLib();
+  const merchantClient = new TalerMerchantInstanceHttpClient(
+    "https://merchant.example.com/",
+    merchant,
+  );
+  await merchantClient
+    .getInstancePrivateAccountKycauth("secret-token" as any, {
+      wireAccountHash: "a/../../evil",
+      exchangeBaseUrl: "https://exchange.example/",
+    })
+    .catch(() => undefined);
+  assert.ok(merchant.lastUrl !== undefined, "no request was made");
+  assert.ok(
+    !merchant.lastUrl!.includes("/evil"),
+    `injection survived: ${merchant.lastUrl}`,
+  );
+});