package httpapi_test

import (
	"testing"

	"github.com/coder/coder/v2/coderd/httpapi"
)

func TestSafeRedirectPath(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name string
		in   string
		want string
	}{
		{"empty", "", "/"},
		{"simple path", "/foo/bar", "/foo/bar"},
		{"path with query", "/foo/bar?baz=qux", "/foo/bar?baz=qux"},
		{"path with fragment", "/foo/bar#wooble", "/foo/bar#wooble"},
		{"path with query+fragment", "/foo/bar?wibble=wobble#wooble", "/foo/bar?wibble=wobble#wooble"},
		{"no leading slash", "foo/bar", "/foo/bar"},
		{"malformed", "http://[::1]:namedport", "/"},
		// Ensure backslashes aren't a blindspot.
		{"backslash after slash", `/\evil.example.com`, "/%5Cevil.example.com"},
		{"leading double backslash", `\\evil.example.com`, "/%5C%5Cevil.example.com"},
		{"backslash then slash", `\/evil.example.com`, "/%5C/evil.example.com"},
		{"mixed slash backslash", `/\/evil.example.com`, "/%5C/evil.example.com"},
		{"scheme with backslash", `https:/\evil.example.com`, "/%5Cevil.example.com"},
		// Cure53 CDM-02-009: triple-slash open redirect.
		{"protocol relative triple slash", "///evil.example.com", "/evil.example.com"},
		{"protocol relative double slash", "//evil.example.com", "/"},
		{"absolute url with host", "http://evil.example.com/path", "/path"},
		{"absolute url with host and query", "https://evil.example.com/path?a=b", "/path?a=b"},
		// Cure53 CDM-02-009: javascript: scheme bypassing CSP.
		{"javascript scheme", "javascript:alert(origin)", "/"},
		{"nested javascript scheme", "javascript:javascript:javascript:alert(origin)", "/"},
		{"data scheme", "data:text/html,<script>alert(origin)</script>", "/"},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			t.Parallel()
			if got := httpapi.SafeRedirectPath(tt.in); got != tt.want {
				t.Errorf("SafeRedirectPath(%q) = %q, want %q", tt.in, got, tt.want)
			}
		})
	}
}