fix(config): harden remote and identity validation

2026-09-05 01:36:10 +08:00
parent d1ad63983b
commit 73cdf7d95c
7 changed files with 89 additions and 23 deletions
@@ -39,3 +39,16 @@ test('parseUrlServers：拒绝空字符串、空数组和非字符串数组项',
  assert.throws(() => parseUrlServers({ data: { urlserver: ['ok:1', ''] } }), /data\.urlserver/);
  assert.throws(() => parseUrlServers({ data: { urlserver: ['ok:1', 2] } }), /data\.urlserver/);
 });
+
+test('parseUrlServers：显式拒绝已有的非 WebSocket scheme', () => {
+  for (const value of [
+    'http://config.example/ws',
+    'https://config.example/ws',
+    'ftp://config.example/ws',
+  ]) {
+    assert.throws(
+      () => parseUrlServers({ data: { urlserver: value } }),
+      /不支持.*scheme/i,
+    );
+  }
+});