(t *testing.T)
| 63 | } |
| 64 | |
| 65 | func TestCallbackHandlerEscapesError(t *testing.T) { |
| 66 | rec, _ := serveCallback(t, "state123", "error=evil&error_description=%3Cscript%3Ealert(1)%3C%2Fscript%3E") |
| 67 | |
| 68 | body := rec.Body.String() |
| 69 | assert.NotContains(t, body, "<script>", "error message must be HTML-escaped") |
| 70 | assert.Contains(t, body, "<script>") |
| 71 | } |
| 72 | |
| 73 | func TestListenCallbackRandomPortIsLoopback(t *testing.T) { |
| 74 | listener, err := listenCallback(0, false) |
nothing calls this directly
no test coverage detected