package api import ( "strings" "testing" ) func TestMediaObjectPath(t *testing.T) { got := mediaObjectPath("../etc", "cover.png") if !strings.HasPrefix(got, "/journal/") { t.Fatalf("path = %q, want /journal/ prefix", got) } if strings.Contains(got, "..") { t.Fatalf("path still contains ..: %q", got) } if got := mediaObjectPath("photos", "a.png"); got != "/journal/photos/a.png" { t.Fatalf("nested = %q", got) } if got := mediaObjectPath("journal/photos", "a.png"); got != "/journal/photos/a.png" { t.Fatalf("prefixed folder = %q", got) } } func TestMediaFolderPatternRejectsDotDot(t *testing.T) { folder := "../etc" if mediaFolderPattern.MatchString(folder) && !strings.Contains(folder, "..") { t.Fatal("folder ../etc should be rejected") } if !strings.Contains(folder, "..") { t.Fatal("test fixture lost ..") } if mediaFolderPattern.MatchString("ok_folder-1") { return } t.Fatal("ok_folder-1 should match") }