spec/requests/jira_connect/users_controller_spec.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

# frozen_string_literal: true

require 'spec_helper'

RSpec.describe JiraConnect::UsersController do
  describe 'GET /-/jira_connect/users' do
    let_it_be(:user) { create(:user) }

    before do
      sign_in(user)
    end

    context 'with a valid host' do
      let(:return_to) { 'https://testcompany.atlassian.net/plugins/servlet/ac/gitlab-jira-connect-staging.gitlab.com/gitlab-configuration' }

      it 'includes a return url' do
        get '/-/jira_connect/users', params: { return_to: return_to }

        expect(response).to have_gitlab_http_status(:ok)
        expect(response.body).to include('Return to GitLab')
      end
    end

    context 'with an invalid host' do
      let(:return_to) { 'https://evil.com' }

      it 'does not include a return url' do
        get '/-/jira_connect/users', params: { return_to: return_to }

        expect(response).to have_gitlab_http_status(:ok)
        expect(response.body).not_to include('Return to GitLab')
      end
    end

    context 'with a script injected' do
      let(:return_to) { 'javascript://test.atlassian.net/%250dalert(document.domain)' }

      it 'does not include a return url' do
        get '/-/jira_connect/users', params: { return_to: return_to }

        expect(response).to have_gitlab_http_status(:ok)
        expect(response.body).not_to include('Return to GitLab')
      end
    end
  end
end