107 lines
3.2 KiB
Go
107 lines
3.2 KiB
Go
package api
|
|
|
|
import (
|
|
"image"
|
|
"image/color"
|
|
"image/png"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"chfs-ng/internal/auth"
|
|
"chfs-ng/internal/storage"
|
|
)
|
|
|
|
func TestAuditExistEnforcesReadPermission(t *testing.T) {
|
|
root := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(root, "secret.txt"), []byte("x"), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
s := &Server{Store: storage.Local{Root: root}, Auth: &auth.Manager{Guest: &auth.Account{Mask: auth.None}}}
|
|
rr := httptest.NewRecorder()
|
|
req := httptest.NewRequest("GET", "/chfs/exist?file=secret.txt", nil)
|
|
s.exist(rr, req)
|
|
if rr.Code != 403 {
|
|
t.Fatalf("exist status=%d want 403", rr.Code)
|
|
}
|
|
}
|
|
|
|
func TestAuditThumbnailRejectsOversizeBeforeDecode(t *testing.T) {
|
|
root := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(root, "big.bin"), make([]byte, 64), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
s := &Server{Store: storage.Local{Root: root}, Auth: &auth.Manager{Guest: &auth.Account{Mask: auth.Read}}, ImagePreview: true, ThumbnailMaxSize: 32}
|
|
rr := httptest.NewRecorder()
|
|
req := httptest.NewRequest("GET", "/chfs/thumbnail?file=big.bin", nil)
|
|
s.thumbnail(rr, req)
|
|
if rr.Code != 413 {
|
|
t.Fatalf("thumbnail status=%d want 413", rr.Code)
|
|
}
|
|
}
|
|
|
|
func TestAuditZipLimitsUseOriginalFileSizes(t *testing.T) {
|
|
root := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(root, "a.txt"), make([]byte, 100), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
s := &Server{Store: storage.Local{Root: root}, ZipMaxSize: 99, ZipMaxFiles: 10}
|
|
a := &auth.Account{Mask: auth.Read}
|
|
if err := s.checkZipLimits(a, []string{""}); err == nil {
|
|
t.Fatal("expected zip size limit")
|
|
}
|
|
}
|
|
|
|
func TestAuditSearchLimit(t *testing.T) {
|
|
root := t.TempDir()
|
|
for _, name := range []string{"a.txt", "b.txt", "c.txt"} {
|
|
if err := os.WriteFile(filepath.Join(root, name), []byte(name), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
s := &Server{Store: storage.Local{Root: root}, Auth: &auth.Manager{Guest: &auth.Account{Mask: auth.Read}}, SearchMaxResults: 2}
|
|
rr := httptest.NewRecorder()
|
|
req := httptest.NewRequest("GET", "/chfs/search?str=.txt", nil)
|
|
s.search(rr, req)
|
|
if rr.Code != 200 {
|
|
t.Fatalf("search status=%d", rr.Code)
|
|
}
|
|
if len(rr.Body.Bytes()) == 0 || !contains(rr.Body.String(), `"truncated":true`) {
|
|
t.Fatalf("search did not report truncation: %s", rr.Body.String())
|
|
}
|
|
}
|
|
|
|
func contains(s, sub string) bool {
|
|
return len(s) >= len(sub) && (s == sub || func() bool {
|
|
for i := 0; i+len(sub) <= len(s); i++ {
|
|
if s[i:i+len(sub)] == sub {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}())
|
|
}
|
|
|
|
func TestAuditThumbnailPixelLimit(t *testing.T) {
|
|
root := t.TempDir()
|
|
img := image.NewRGBA(image.Rect(0, 0, 20, 20))
|
|
img.Set(0, 0, color.White)
|
|
f, err := os.Create(filepath.Join(root, "large.png"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := png.Encode(f, img); err != nil {
|
|
f.Close()
|
|
t.Fatal(err)
|
|
}
|
|
f.Close()
|
|
s := &Server{Store: storage.Local{Root: root}, Auth: &auth.Manager{Guest: &auth.Account{Mask: auth.Read}}, ImagePreview: true, ThumbnailMaxPixels: 100}
|
|
rr := httptest.NewRecorder()
|
|
req := httptest.NewRequest("GET", "/chfs/thumbnail?file=large.png", nil)
|
|
s.thumbnail(rr, req)
|
|
if rr.Code != 415 {
|
|
t.Fatalf("thumbnail pixel-limit status=%d want 415", rr.Code)
|
|
}
|
|
}
|