
































@@ -1,4 +1,5 @@
11import os from "node:os";
2+import path from "node:path";
23import { afterEach, describe, expect, it, vi } from "vitest";
34import {
45normalizeGatewayTokenInput,
@@ -39,17 +40,19 @@ vi.mock("../gateway/probe.js", () => ({
3940}));
40414142afterEach(() => {
43+vi.clearAllMocks();
4244vi.restoreAllMocks();
4345vi.unstubAllEnvs();
4446});
45474648describe("openUrl", () => {
47-it("passes OAuth URLs to explorer.exe on win32 without cmd parsing", async () => {
49+it("passes OAuth URLs to Windows FileProtocolHandler without cmd parsing", async () => {
4850vi.stubEnv("VITEST", "");
4951vi.stubEnv("NODE_ENV", "");
52+vi.stubEnv("SystemRoot", "C:\\Windows");
5053const platformSpy = vi.spyOn(process, "platform", "get").mockReturnValue("win32");
51-vi.stubEnv("VITEST", "");
5254vi.stubEnv("NODE_ENV", "development");
55+const rundll32 = path.win32.join("C:\\Windows", "System32", "rundll32.exe");
53565457const url =
5558"https://accounts.google.com/o/oauth2/v2/auth?client_id=abc&response_type=code&redirect_uri=http%3A%2F%2Flocalhost";
@@ -59,20 +62,36 @@ describe("openUrl", () => {
59626063expect(mocks.runCommandWithTimeout).toHaveBeenCalledTimes(1);
6164const [argv, options] = mocks.runCommandWithTimeout.mock.calls[0] ?? [];
62-expect(argv).toEqual(["explorer.exe", url]);
65+expect(argv).toEqual([rundll32, "url.dll,FileProtocolHandler", url]);
6366expect(options).toMatchObject({ timeoutMs: 5_000 });
6467expect(options?.windowsVerbatimArguments).toBeUndefined();
65686669platformSpy.mockRestore();
6770});
71+72+it("does not pass non-http URLs to the OS browser handler", async () => {
73+vi.stubEnv("VITEST", "");
74+vi.stubEnv("NODE_ENV", "development");
75+const platformSpy = vi.spyOn(process, "platform", "get").mockReturnValue("win32");
76+77+const ok = await openUrl("file://C:/Users/test/secrets.txt");
78+79+expect(ok).toBe(false);
80+expect(mocks.runCommandWithTimeout).not.toHaveBeenCalled();
81+82+platformSpy.mockRestore();
83+});
6884});
69857086describe("resolveBrowserOpenCommand", () => {
71-it("uses explorer.exe on win32", async () => {
87+it("uses trusted rundll32 on win32", async () => {
88+vi.stubEnv("SystemRoot", "C:\\Windows");
7289const platformSpy = vi.spyOn(process, "platform", "get").mockReturnValue("win32");
90+const rundll32 = path.win32.join("C:\\Windows", "System32", "rundll32.exe");
91+7392const resolved = await resolveBrowserOpenCommand();
74-expect(resolved.argv).toEqual(["explorer.exe"]);
75-expect(resolved.command).toBe("explorer.exe");
93+expect(resolved.argv).toEqual([rundll32, "url.dll,FileProtocolHandler"]);
94+expect(resolved.command).toBe(rundll32);
7695platformSpy.mockRestore();
7796});
7897});
此内容由惯性聚合(RSS阅读器)自动聚合整理,仅供阅读参考。 原文来自 — 版权归原作者所有。