Redmine

    force_ssl_in_redirect_uri do |uri|

      hostname = uri.hostname.to_s

      !(%w[localhost 127.0.0.1 ::1].include?(hostname) || hostname.end_with?('.localhost'))

    end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require_relative '../test_helper'

class OauthRedirectUriTest < ActiveSupport::TestCase

  def test_http_redirect_uri_should_be_allowed_for_loopback_hosts

    %w[

      http://localhost:3000/callback

      http://127.0.0.1:3000/callback

      http://[::1]:3000/callback

      http://app.localhost:3000/callback

    ].each do |uri|

      assert_empty redirect_uri_errors(uri), uri

    end

  end

  def test_http_redirect_uri_should_be_rejected_for_other_hosts

    %w[

      http://example.com/callback

      http://localhost.example.com/callback

      http://notlocalhost/callback

    ].each do |uri|

      assert_not_empty redirect_uri_errors(uri), uri

    end

  end

  private

  def redirect_uri_errors(redirect_uri)

    application = Doorkeeper::Application.new(name: 'test', redirect_uri: redirect_uri)

    application.valid?

    application.errors[:redirect_uri]

  end

end