Jakub Zych
15fcad7a93
- classes.StoreMedia holds the media upload route's storage: extension allowlist, 10240 KiB cap, /journal/<folder>/<name> keys with the unique suffix, bucket write and public URL - UploadMedia keeps authentication, permissions, the folder and form checks and answers with the same 201 body and messages - uniqueMediaKey fails instead of overwriting when every numbered name is taken; the media path tests move to classes
40 lines
1.0 KiB
Go
40 lines
1.0 KiB
Go
package classes
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestMediaObjectPath(t *testing.T) {
|
|
got := mediaObjectPath("../etc", "cover.png")
|
|
if !strings.HasPrefix(got, "/journal/") {
|
|
t.Fatalf("path = %q, want /journal/ prefix", got)
|
|
}
|
|
if strings.Contains(got, "..") {
|
|
t.Fatalf("path still contains ..: %q", got)
|
|
}
|
|
if got := mediaObjectPath("photos", "a.png"); got != "/journal/photos/a.png" {
|
|
t.Fatalf("nested = %q", got)
|
|
}
|
|
if got := mediaObjectPath("journal/photos", "a.png"); got != "/journal/photos/a.png" {
|
|
t.Fatalf("prefixed folder = %q", got)
|
|
}
|
|
if got := mediaObjectPath("", "a.png"); got != "/journal/a.png" {
|
|
t.Fatalf("no folder = %q", got)
|
|
}
|
|
}
|
|
|
|
func TestMediaFolderPatternRejectsDotDot(t *testing.T) {
|
|
folder := "../etc"
|
|
if MediaFolderPattern.MatchString(folder) && !strings.Contains(folder, "..") {
|
|
t.Fatal("folder ../etc should be rejected")
|
|
}
|
|
if !strings.Contains(folder, "..") {
|
|
t.Fatal("test fixture lost ..")
|
|
}
|
|
if MediaFolderPattern.MatchString("ok_folder-1") {
|
|
return
|
|
}
|
|
t.Fatal("ok_folder-1 should match")
|
|
}
|