Fix GHSA-r5fr-rjxr-66jc and high-severity code vulnerabilities; add test suite (#20)

* Add comprehensive test suite for unit and integration testing

Agent-Logs-Url: https://github.com/esoadamo/cloudflare-oidc-proxy/sessions/098e5a23-1790-47f9-9c1b-7ab07d73f537

Co-authored-by: esoadamo <15877754+esoadamo@users.noreply.github.com>

* Fix security vulnerabilities: lodash GHSA-r5fr-rjxr-66jc, XSS, open redirect, JWT crash

Agent-Logs-Url: https://github.com/esoadamo/cloudflare-oidc-proxy/sessions/098e5a23-1790-47f9-9c1b-7ab07d73f537

Co-authored-by: esoadamo <15877754+esoadamo@users.noreply.github.com>

* Update package.json

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Add test job to docker publish workflow (gates push on passing tests)

Agent-Logs-Url: https://github.com/esoadamo/cloudflare-oidc-proxy/sessions/e1ad75fd-7427-48d5-8174-bc84fef60870

Co-authored-by: esoadamo <15877754+esoadamo@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: esoadamo <15877754+esoadamo@users.noreply.github.com>
Co-authored-by: Adam Hlaváček <git@adamhlavacek.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: 3 people

.github/workflows/build-docker.yml

@@ -6,8 +6,28 @@ on:
       - main
 
 jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v3
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test
+
   build_and_push:
     runs-on: ubuntu-latest
+    needs: test
 
     steps:
       - name: Check out the repository, including submodules

index.js

@@ -59,7 +59,7 @@ async function main() {
                 } else if (req.method === 'GET' || req.method === 'HEAD') {
                     res.redirect(url.format({
                         protocol: 'https',
-                        host: req.get('host'),
+                        host: req.hostname,
                         pathname: req.originalUrl,
                     }));
                 } else {