d09edde080
Named JOURNAL-001/002 fillable, FormatHTML unsafe tags, rollback/remigrate, RSS/categories/tags/media, and TestSearchGateOff with zero Typesense HTTP. Co-authored-by: Cursor <cursoragent@cursor.com>
37 lines
948 B
Go
37 lines
948 B
Go
package api
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestMediaObjectPath(t *testing.T) {
|
|
got := mediaObjectPath("../etc", "cover.png")
|
|
if !strings.HasPrefix(got, "/journal/") {
|
|
t.Fatalf("path = %q, want /journal/ prefix", got)
|
|
}
|
|
if strings.Contains(got, "..") {
|
|
t.Fatalf("path still contains ..: %q", got)
|
|
}
|
|
if got := mediaObjectPath("photos", "a.png"); got != "/journal/photos/a.png" {
|
|
t.Fatalf("nested = %q", got)
|
|
}
|
|
if got := mediaObjectPath("journal/photos", "a.png"); got != "/journal/photos/a.png" {
|
|
t.Fatalf("prefixed folder = %q", got)
|
|
}
|
|
}
|
|
|
|
func TestMediaFolderPatternRejectsDotDot(t *testing.T) {
|
|
folder := "../etc"
|
|
if mediaFolderPattern.MatchString(folder) && !strings.Contains(folder, "..") {
|
|
t.Fatal("folder ../etc should be rejected")
|
|
}
|
|
if !strings.Contains(folder, "..") {
|
|
t.Fatal("test fixture lost ..")
|
|
}
|
|
if mediaFolderPattern.MatchString("ok_folder-1") {
|
|
return
|
|
}
|
|
t.Fatal("ok_folder-1 should match")
|
|
}
|