88 lines
2.9 KiB
TypeScript
88 lines
2.9 KiB
TypeScript
|
import { describe, it, expect } from 'vitest';
|
||
|
|
import { safeDownloadName, contentDisposition } from '@/lib/downloadName';
|
||
|
|
|
||
|
|
const LF = String.fromCharCode(10);
|
||
|
|
const CRLF = String.fromCharCode(13, 10);
|
||
|
|
const NUL = String.fromCharCode(0);
|
||
|
|
const QUOTE = String.fromCharCode(34);
|
||
|
|
|
||
|
|
/** True if the string holds any control character. */
|
||
|
|
const hasControlChar = (value: string) =>
|
||
|
|
Array.from(value).some((character) => {
|
||
|
|
const code = character.charCodeAt(0);
|
||
|
|
return code < 32 || code === 127;
|
||
|
|
});
|
||
|
|
|
||
|
|
describe('safeDownloadName', () => {
|
||
|
|
it('passes an ordinary camera filename through', () => {
|
||
|
|
expect(safeDownloadName('DSCF1234.JPG')).toBe('DSCF1234.JPG');
|
||
|
|
});
|
||
|
|
|
||
|
|
it('keeps non-ASCII letters, which are a legitimate part of a name', () => {
|
||
|
|
expect(safeDownloadName('Fr\u00fchling am Meer.jpg')).toBe('Fr\u00fchling am Meer.jpg');
|
||
|
|
});
|
||
|
|
|
||
|
|
/** The header injection this exists to prevent. */
|
||
|
|
it.each([
|
||
|
|
['a newline', `a${LF}X-Evil: 1.jpg`],
|
||
|
|
['a CRLF', `a${CRLF}X-Evil: 1.jpg`],
|
||
|
|
['a null byte', `a${NUL}b.jpg`],
|
||
|
|
])('strips %s', (_label, raw) => {
|
||
|
|
expect(hasControlChar(safeDownloadName(raw))).toBe(false);
|
||
|
|
});
|
||
|
|
|
||
|
|
it('neutralises path separators and traversal', () => {
|
||
|
|
expect(safeDownloadName('../../etc/passwd')).not.toContain('/');
|
||
|
|
expect(safeDownloadName('..\\..\\secret.jpg')).not.toContain('\\');
|
||
|
|
expect(safeDownloadName('../evil.jpg').startsWith('.')).toBe(false);
|
||
|
|
});
|
||
|
|
|
||
|
|
it('removes the quotes and semicolons that delimit header parameters', () => {
|
||
|
|
expect(safeDownloadName(`a${QUOTE};b.jpg`)).toBe('ab.jpg');
|
||
|
|
});
|
||
|
|
|
||
|
|
it.each([
|
||
|
|
['undefined', undefined],
|
||
|
|
['empty', ''],
|
||
|
|
['whitespace', ' '],
|
||
|
|
['only dots', '...'],
|
||
|
|
])('falls back to a generic name for %s', (_label, raw) => {
|
||
|
|
expect(safeDownloadName(raw)).toBe('photo');
|
||
|
|
});
|
||
|
|
|
||
|
|
it('never returns an empty name', () => {
|
||
|
|
for (const raw of ['///', QUOTE.repeat(3), '..', ' . ', NUL]) {
|
||
|
|
expect(safeDownloadName(raw).length).toBeGreaterThan(0);
|
||
|
|
}
|
||
|
|
});
|
||
|
|
|
||
|
|
it('bounds the length', () => {
|
||
|
|
expect(safeDownloadName('x'.repeat(5000)).length).toBeLessThanOrEqual(200);
|
||
|
|
});
|
||
|
|
});
|
||
|
|
|
||
|
|
describe('contentDisposition', () => {
|
||
|
|
it('marks the response as an attachment', () => {
|
||
|
|
expect(contentDisposition('DSCF1234.JPG')).toMatch(/^attachment; /);
|
||
|
|
});
|
||
|
|
|
||
|
|
it('carries both a plain and a percent-encoded filename', () => {
|
||
|
|
const header = contentDisposition('Fr\u00fchling.jpg');
|
||
|
|
expect(header).toContain('filename="Fr_hling.jpg"');
|
||
|
|
expect(header).toContain("filename*=UTF-8''Fr%C3%BChling.jpg");
|
||
|
|
});
|
||
|
|
|
||
|
|
it('never emits a control character, whatever it is given', () => {
|
||
|
|
expect(hasControlChar(contentDisposition(`a${CRLF}X-Evil: 1.jpg`))).toBe(false);
|
||
|
|
});
|
||
|
|
|
||
|
|
it('never emits an unbalanced quote', () => {
|
||
|
|
const header = contentDisposition(`a${QUOTE}b.jpg`);
|
||
|
|
expect((header.match(/"/g) ?? []).length % 2).toBe(0);
|
||
|
|
});
|
||
|
|
|
||
|
|
it('survives a missing name', () => {
|
||
|
|
expect(contentDisposition(undefined)).toContain('filename="photo"');
|
||
|
|
});
|
||
|
|
});
|