svrjs/tests/middleware/urlSanitizer.test.js

const middleware = require("../../src/middleware/urlSanitizer.js");
const sanitizeURL = require("../../src/utils/urlSanitizer.js");
const parseURL = require("../../src/utils/urlParser.js");

jest.mock("../../src/utils/urlSanitizer.js");
jest.mock("../../src/utils/urlParser.js");

describe("Path sanitizer middleware", () => {
  let req, res, logFacilities, config, next;

  beforeEach(() => {
    req = {
      parsedURL: {
        pathname: "/test",
        search: "?query=test",
        hash: "#hash"
      },
      url: "/test?query=test#hash",
      isProxy: false,
      headers: {
        host: "test.com"
      },
      socket: {
        encrypted: false
      }
    };
    res = {
      redirect: jest.fn(),
      error: jest.fn()
    };
    logFacilities = {
      resmessage: jest.fn()
    };
    config = {
      allowDoubleSlashes: false,
      rewriteDirtyURLs: false,
      domain: "test.com"
    };
    next = jest.fn();

    sanitizeURL.mockImplementation((url) => url);
    parseURL.mockImplementation((url) => ({ pathname: url }));
  });

  test("should call next if URL is not dirty", () => {
    middleware(req, res, logFacilities, config, next);
    expect(next).toHaveBeenCalled();
  });

  test("should redirect if URL is dirty and rewriteDirtyURLs is false", () => {
    req.parsedURL.pathname = "/dirty%20url";
    middleware(req, res, logFacilities, config, next);
    expect(res.redirect).toHaveBeenCalledWith(
      "/dirty%20url?query=test#hash",
      false
    );
    expect(next).not.toHaveBeenCalled();
  });

  test("should rewrite URL if URL is dirty and rewriteDirtyURLs is true", () => {
    req.parsedURL.pathname = "/dirty%20url";
    config.rewriteDirtyURLs = true;
    middleware(req, res, logFacilities, config, next);
    expect(req.url).toBe("/dirty%20url?query=test#hash");
    expect(next).toHaveBeenCalled();
  });

  test("should redirect if URL is dirty (sanitized via sanitizeURL) and rewriteDirtyURLs is false", () => {
    req.parsedURL.pathname = "/dirty%20url";
    sanitizeURL.mockImplementation((url) => url.replace(/dirty/g, "clean"));
    middleware(req, res, logFacilities, config, next);
    expect(res.redirect).toHaveBeenCalledWith(
      "/clean%20url?query=test#hash",
      false
    );
    expect(next).not.toHaveBeenCalled();
  });

  test("should rewrite URL if URL is dirty (sanitized via sanitizeURL) and rewriteDirtyURLs is true", () => {
    req.parsedURL.pathname = "/dirty%20url";
    config.rewriteDirtyURLs = true;
    sanitizeURL.mockImplementation((url) => url.replace(/dirty/g, "clean"));
    middleware(req, res, logFacilities, config, next);
    expect(req.url).toBe("/clean%20url?query=test#hash");
    expect(next).toHaveBeenCalled();
  });

  test("should handle parseURL errors", () => {
    req.parsedURL.pathname = "/dirty%20url";
    config.rewriteDirtyURLs = true;
    sanitizeURL.mockImplementation((url) => url.replace(/dirty/g, "clean"));
    parseURL.mockImplementation(() => {
      throw new Error("Parse error");
    });
    middleware(req, res, logFacilities, config, next);
    expect(res.error).toHaveBeenCalledWith(400, new Error("Parse error"));
    expect(next).not.toHaveBeenCalled();
  });
});