Don't export isGithubUrl

Author: akirk

packages/playground/website/src/github/git-auth-helpers.spec.ts

@@ -1,84 +1,12 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest';
-import { createGitHubAuthHeaders, isGitHubUrl } from './git-auth-helpers';
+import { createGitHubAuthHeaders } from './git-auth-helpers';
 import { oAuthState } from './state';
 
 vi.mock('virtual:cors-proxy-url', () => ({
 	corsProxyUrl: 'https://corsproxyurl/',
 }));
 
-describe('isGitHubUrl', () => {
-	describe('direct GitHub URLs', () => {
-		it('returns true for github.com URLs', () => {
-			expect(isGitHubUrl('https://github.com/user/repo')).toBe(true);
-		});
-
-		it('returns true for api.github.com URLs', () => {
-			expect(isGitHubUrl('https://api.github.com/repos')).toBe(true);
-		});
-
-		it('returns false for non-GitHub URLs', () => {
-			expect(isGitHubUrl('https://gitlab.com/user/repo')).toBe(false);
-			expect(isGitHubUrl('https://bitbucket.org/user/repo')).toBe(false);
-		});
-	});
-
-	describe('security: rejects URLs with github.com in wrong places', () => {
-		it('returns false when github.com is in the path', () => {
-			expect(isGitHubUrl('https://evil.com/github.com/fake')).toBe(false);
-		});
-
-		it('returns false when github.com is in a query parameter', () => {
-			expect(isGitHubUrl('https://evil.com?redirect=github.com')).toBe(
-				false
-			);
-		});
-
-		it('returns false for look-alike domains', () => {
-			expect(isGitHubUrl('https://github.com.evil.com')).toBe(false);
-			expect(isGitHubUrl('https://mygithub.com')).toBe(false);
-			expect(isGitHubUrl('https://fakegithub.com')).toBe(false);
-		});
-	});
-
-	describe('CORS proxy URLs', () => {
-		it('returns true for GitHub URLs through CORS proxy', () => {
-			expect(
-				isGitHubUrl(
-					'https://corsproxyurl/?https://github.com/user/repo'
-				)
-			).toBe(true);
-		});
-
-		it('returns false for non-GitHub URLs through CORS proxy', () => {
-			expect(
-				isGitHubUrl(
-					'https://corsproxyurl/?https://gitlab.com/user/repo'
-				)
-			).toBe(false);
-		});
-
-		it('returns false for malicious URLs through CORS proxy', () => {
-			expect(
-				isGitHubUrl(
-					'https://corsproxyurl/?https://evil.com/github.com/fake'
-				)
-			).toBe(false);
-			expect(
-				isGitHubUrl('https://corsproxyurl/?https://github.com.evil.com')
-			).toBe(false);
-		});
-	});
-
-	describe('edge cases', () => {
-		it('returns false for invalid URLs', () => {
-			expect(isGitHubUrl('not-a-url')).toBe(false);
-			expect(isGitHubUrl('')).toBe(false);
-			expect(isGitHubUrl('github.com')).toBe(false);
-		});
-	});
-});
-
-describe('createGitHubAuthHeaders integration', () => {
+describe('createGitHubAuthHeaders', () => {
 	beforeEach(() => {
 		oAuthState.value = { token: '', isAuthorizing: false };
 	});
@@ -127,7 +55,23 @@ describe('createGitHubAuthHeaders integration', () => {
 
 			expect(getHeaders('https://gitlab.com/user/repo')).toEqual({});
 			expect(getHeaders('https://bitbucket.org/user/repo')).toEqual({});
+		});
+
+		it('does NOT include Authorization header for malicious URLs (security)', () => {
+			const getHeaders = createGitHubAuthHeaders();
+
+			// github.com in path
 			expect(getHeaders('https://evil.com/github.com/fake')).toEqual({});
+
+			// github.com in query parameter
+			expect(getHeaders('https://evil.com?redirect=github.com')).toEqual(
+				{}
+			);
+
+			// look-alike domains
+			expect(getHeaders('https://github.com.evil.com')).toEqual({});
+			expect(getHeaders('https://mygithub.com')).toEqual({});
+			expect(getHeaders('https://fakegithub.com')).toEqual({});
 		});
 
 		it('does NOT include Authorization header for non-GitHub URLs through CORS proxy', () => {
@@ -138,6 +82,20 @@ describe('createGitHubAuthHeaders integration', () => {
 
 			expect(headers).toEqual({});
 		});
+
+		it('does NOT include Authorization header for malicious URLs through CORS proxy (security)', () => {
+			const getHeaders = createGitHubAuthHeaders();
+
+			expect(
+				getHeaders(
+					'https://corsproxyurl/?https://evil.com/github.com/fake'
+				)
+			).toEqual({});
+
+			expect(
+				getHeaders('https://corsproxyurl/?https://github.com.evil.com')
+			).toEqual({});
+		});
 	});
 
 	describe('without GitHub token', () => {

packages/playground/website/src/github/git-auth-helpers.ts

@@ -1,7 +1,7 @@
 import { oAuthState } from './state';
 import { corsProxyUrl } from 'virtual:cors-proxy-url';
 
-export function isGitHubUrl(url: string): boolean {
+function isGitHubUrl(url: string): boolean {
 	try {
 		const urlObj = new URL(url);
 		const corsProxyOrigin = new URL(corsProxyUrl).origin;