snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/tests/unit/server/lib/shared/disableCustomScripts.tests.ts

@@ -0,0 +1,69 @@
+import { expect } from 'chai';
+import proxyquire from 'proxyquire';
+import sinon from 'sinon';
+
+describe('disableCustomScripts', () => {
+	let mockLicense: sinon.SinonStubbedInstance<any>;
+	let disableCustomScripts: () => boolean;
+	let disableCustomScriptsVar: any;
+
+	beforeEach(() => {
+		disableCustomScriptsVar = process.env.DISABLE_CUSTOM_SCRIPTS;
+		mockLicense = {
+			getLicense: sinon.stub(),
+		};
+
+		disableCustomScripts = proxyquire('../../../../../server/lib/shared/disableCustomScripts.ts', {
+			'@rocket.chat/license': { License: mockLicense },
+		}).disableCustomScripts;
+	});
+
+	afterEach(() => {
+		process.env.DISABLE_CUSTOM_SCRIPTS = disableCustomScriptsVar;
+		sinon.restore();
+	});
+
+	it('should return false when license is missing', () => {
+		mockLicense.getLicense.returns(null);
+
+		const result = disableCustomScripts();
+		expect(result).to.be.false;
+	});
+
+	it('should return false when DISABLE_CUSTOM_SCRIPTS is not true', () => {
+		mockLicense.getLicense.returns({
+			information: {
+				trial: true,
+			},
+		});
+
+		const result = disableCustomScripts();
+		expect(result).to.be.false;
+	});
+
+	it('should return false when license is not a trial', () => {
+		mockLicense.getLicense.returns({
+			information: {
+				trial: false,
+			},
+		});
+
+		process.env.DISABLE_CUSTOM_SCRIPTS = 'true';
+
+		const result = disableCustomScripts();
+		expect(result).to.be.false;
+	});
+
+	it('should return true when DISABLE_CUSTOM_SCRIPTS is true and license is a trial', () => {
+		mockLicense.getLicense.returns({
+			information: {
+				trial: true,
+			},
+		});
+
+		process.env.DISABLE_CUSTOM_SCRIPTS = 'true';
+
+		const result = disableCustomScripts();
+		expect(result).to.be.true;
+	});
+});

apps/meteor/tests/unit/server/lib/shared/getModifiedHttpHeaders.tests.ts

@@ -0,0 +1,74 @@
+import { expect } from 'chai';
+
+import { getModifiedHttpHeaders } from '../../../../../server/lib/shared/getModifiedHttpHeaders';
+
+const inputVariants = [
+	{
+		label: 'HTTP path (Headers instance)',
+		makeInput: (headers: Record<string, string>) => new Headers(headers),
+	},
+	{
+		label: 'DDP path (plain object)',
+		makeInput: (headers: Record<string, string>) => headers,
+	},
+];
+
+describe('getModifiedHttpHeaders', () => {
+	for (const { label, makeInput } of inputVariants) {
+		describe(label, () => {
+			it('should redact x-auth-token if present', () => {
+				const inputHeaders = {
+					'x-auth-token': '12345',
+					'some-other-header': 'value',
+				};
+				const result = getModifiedHttpHeaders(makeInput(inputHeaders));
+				expect(result['x-auth-token']).to.equal('[redacted]');
+				expect(result['some-other-header']).to.equal('value');
+			});
+
+			it('should not modify headers if x-auth-token is not present', () => {
+				const inputHeaders = {
+					'some-other-header': 'value',
+				};
+				const result = getModifiedHttpHeaders(makeInput(inputHeaders));
+				expect(result).to.deep.equal(inputHeaders);
+			});
+
+			it('should redact rc_token in cookies if present', () => {
+				const inputHeaders = {
+					cookie: 'session_id=abc123; rc_token=98765; other_cookie=value',
+				};
+				const expectedCookies = 'session_id=abc123; rc_token=[redacted]; other_cookie=value';
+				const result = getModifiedHttpHeaders(makeInput(inputHeaders));
+				expect(result.cookie).to.equal(expectedCookies);
+			});
+
+			it('should not modify cookies if rc_token is not present', () => {
+				const inputHeaders = {
+					cookie: 'session_id=abc123; other_cookie=value',
+				};
+				const result = getModifiedHttpHeaders(makeInput(inputHeaders));
+				expect(result.cookie).to.equal(inputHeaders.cookie);
+			});
+
+			it('should return headers unchanged if neither x-auth-token nor cookie are present', () => {
+				const inputHeaders = {
+					'some-other-header': 'value',
+				};
+				const result = getModifiedHttpHeaders(makeInput(inputHeaders));
+				expect(result).to.deep.equal(inputHeaders);
+			});
+
+			it('should handle cases with both x-auth-token and rc_token in cookie', () => {
+				const inputHeaders = {
+					'x-auth-token': '12345',
+					'cookie': 'session_id=abc123; rc_token=98765; other_cookie=value',
+				};
+				const expectedCookies = 'session_id=abc123; rc_token=[redacted]; other_cookie=value';
+				const result = getModifiedHttpHeaders(makeInput(inputHeaders));
+				expect(result['x-auth-token']).to.equal('[redacted]');
+				expect(result.cookie).to.equal(expectedCookies);
+			});
+		});
+	}
+});

apps/meteor/tests/unit/server/lib/shared/validateNameChars.tests.ts

@@ -0,0 +1,56 @@
+import { expect } from 'chai';
+
+import { validateNameChars } from '../../../../../server/lib/shared/validateNameChars';
+
+describe('validateNameChars', () => {
+	it('should return false for undefined input', () => {
+		expect(validateNameChars(undefined)).to.be.false;
+	});
+
+	it('should return false for non-string input', () => {
+		expect(validateNameChars(123 as any)).to.be.false;
+		expect(validateNameChars({} as any)).to.be.false;
+		expect(validateNameChars([] as any)).to.be.false;
+	});
+
+	it('should return false for names with invalid characters', () => {
+		expect(validateNameChars('name<')).to.be.false;
+		expect(validateNameChars('name>')).to.be.false;
+		expect(validateNameChars('name/')).to.be.false;
+		expect(validateNameChars('name\\')).to.be.false;
+	});
+
+	it('should return false for names with invalid characters after decoding', () => {
+		expect(validateNameChars('name%3E')).to.be.false;
+		expect(validateNameChars('name%5C')).to.be.false;
+		expect(validateNameChars('name%3C')).to.be.false;
+	});
+
+	it('should return false for malicious HTML payloads', () => {
+		expect(validateNameChars('<script>alert("XSS");</script>')).to.be.false;
+		expect(validateNameChars('%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E')).to.be.false;
+		expect(
+			validateNameChars(
+				'<form action="http://malicious.site" method="post"><input type="text" name="username" value="Enter username"><input type="password" name="password" value="Enter password"><input type="submit" value="Submit"></form>',
+			),
+		).to.be.false;
+		expect(
+			validateNameChars(
+				'%3Cform%20action%3D%22http%3A%2F%2Fmalicious.site%22%20method%3D%22post%22%3E%3Cinput%20type%3D%22text%22%20name%3D%22username%22%20value%3D%22Enter%20username%22%3E%3Cinput%20type%3D%22password%22%20name%3D%22password%22%20value%3D%22Enter%20password%22%3E%3Cinput%20type%3D%22submit%22%20value%3D%22Submit%22%3E%3C%2Fform%3E',
+			),
+		).to.be.false;
+	});
+
+	it('should return false if decodeURI throws an error', () => {
+		expect(validateNameChars('%')).to.be.false;
+		expect(validateNameChars('%E0%A4%A')).to.be.false;
+	});
+
+	it('should return true for valid names', () => {
+		expect(validateNameChars('name')).to.be.true;
+		expect(validateNameChars('valid_name')).to.be.true;
+		expect(validateNameChars('valid-name')).to.be.true;
+		expect(validateNameChars('valid.name')).to.be.true;
+		expect(validateNameChars('valid name')).to.be.true;
+	});
+});