feat: unit tests for security/utility functions (isPrivateIP, isTransientError, markdown, escapeHtml)

src/__tests__/network.test.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect } from "vitest";
+import { isPrivateIP } from "../utils/network.js";
+
+describe("isPrivateIP", () => {
+  describe("IPv4 private ranges", () => {
+    it("detects 10.x.x.x as private", () => {
+      expect(isPrivateIP("10.0.0.1")).toBe(true);
+      expect(isPrivateIP("10.255.255.255")).toBe(true);
+    });
+    it("detects 172.16-31.x.x as private", () => {
+      expect(isPrivateIP("172.16.0.1")).toBe(true);
+      expect(isPrivateIP("172.31.255.255")).toBe(true);
+    });
+    it("detects 192.168.x.x as private", () => {
+      expect(isPrivateIP("192.168.0.1")).toBe(true);
+      expect(isPrivateIP("192.168.255.255")).toBe(true);
+    });
+    it("detects 127.x.x.x (loopback) as private", () => {
+      expect(isPrivateIP("127.0.0.1")).toBe(true);
+      expect(isPrivateIP("127.255.255.255")).toBe(true);
+    });
+    it("detects 0.0.0.0 as private", () => {
+      expect(isPrivateIP("0.0.0.0")).toBe(true);
+    });
+    it("detects 169.254.x.x (link-local) as private", () => {
+      expect(isPrivateIP("169.254.1.1")).toBe(true);
+    });
+  });
+
+  describe("IPv4 public addresses", () => {
+    it("allows 8.8.8.8", () => expect(isPrivateIP("8.8.8.8")).toBe(false));
+    it("allows 1.1.1.1", () => expect(isPrivateIP("1.1.1.1")).toBe(false));
+    it("allows 172.15.0.1 (just below range)", () => expect(isPrivateIP("172.15.0.1")).toBe(false));
+    it("allows 172.32.0.1 (just above range)", () => expect(isPrivateIP("172.32.0.1")).toBe(false));
+  });
+
+  describe("IPv6", () => {
+    it("detects ::1 (loopback) as private", () => expect(isPrivateIP("::1")).toBe(true));
+    it("detects :: (unspecified) as private", () => expect(isPrivateIP("::")).toBe(true));
+    it("detects fe80::1 (link-local) as private", () => expect(isPrivateIP("fe80::1")).toBe(true));
+    it("detects fc00::1 (unique local) as private", () => expect(isPrivateIP("fc00::1")).toBe(true));
+    it("detects fd00::1 (unique local) as private", () => expect(isPrivateIP("fd00::1")).toBe(true));
+  });
+
+  describe("IPv4-mapped IPv6", () => {
+    it("detects ::ffff:10.0.0.1 as private", () => expect(isPrivateIP("::ffff:10.0.0.1")).toBe(true));
+    it("allows ::ffff:8.8.8.8 as public", () => expect(isPrivateIP("::ffff:8.8.8.8")).toBe(false));
+  });
+
+  describe("edge cases", () => {
+    it("returns false for empty string", () => expect(isPrivateIP("")).toBe(false));
+    it("returns false for random text", () => expect(isPrivateIP("not-an-ip")).toBe(false));
+  });
+});