a813433891
Twenty-nine commits since v0.12.0. See CHANGELOG.md for the full list and the upgrade notes. Ten additions — the SEO package (site URL, robots.txt, sitemap.xml, JSON-LD), slideshow mode, opt-in original downloads, copy-link, previous/next album navigation, alt text from the Immich description, per-album location precision, the update notice, a Help tab, and a subpage cover grid separate from its photo grid. Two fixes: CJK album slugs, and the lightbox control bar. Photo of the Day (#476) was built on `dev` and reverted as not planned; it never appears in a release. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01DmsHVRL9yQvckUB1ZpVWre --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
88 lines
2.9 KiB
TypeScript
88 lines
2.9 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import { safeDownloadName, contentDisposition } from '@/lib/downloadName';
|
|
|
|
const LF = String.fromCharCode(10);
|
|
const CRLF = String.fromCharCode(13, 10);
|
|
const NUL = String.fromCharCode(0);
|
|
const QUOTE = String.fromCharCode(34);
|
|
|
|
/** True if the string holds any control character. */
|
|
const hasControlChar = (value: string) =>
|
|
Array.from(value).some((character) => {
|
|
const code = character.charCodeAt(0);
|
|
return code < 32 || code === 127;
|
|
});
|
|
|
|
describe('safeDownloadName', () => {
|
|
it('passes an ordinary camera filename through', () => {
|
|
expect(safeDownloadName('DSCF1234.JPG')).toBe('DSCF1234.JPG');
|
|
});
|
|
|
|
it('keeps non-ASCII letters, which are a legitimate part of a name', () => {
|
|
expect(safeDownloadName('Fr\u00fchling am Meer.jpg')).toBe('Fr\u00fchling am Meer.jpg');
|
|
});
|
|
|
|
/** The header injection this exists to prevent. */
|
|
it.each([
|
|
['a newline', `a${LF}X-Evil: 1.jpg`],
|
|
['a CRLF', `a${CRLF}X-Evil: 1.jpg`],
|
|
['a null byte', `a${NUL}b.jpg`],
|
|
])('strips %s', (_label, raw) => {
|
|
expect(hasControlChar(safeDownloadName(raw))).toBe(false);
|
|
});
|
|
|
|
it('neutralises path separators and traversal', () => {
|
|
expect(safeDownloadName('../../etc/passwd')).not.toContain('/');
|
|
expect(safeDownloadName('..\\..\\secret.jpg')).not.toContain('\\');
|
|
expect(safeDownloadName('../evil.jpg').startsWith('.')).toBe(false);
|
|
});
|
|
|
|
it('removes the quotes and semicolons that delimit header parameters', () => {
|
|
expect(safeDownloadName(`a${QUOTE};b.jpg`)).toBe('ab.jpg');
|
|
});
|
|
|
|
it.each([
|
|
['undefined', undefined],
|
|
['empty', ''],
|
|
['whitespace', ' '],
|
|
['only dots', '...'],
|
|
])('falls back to a generic name for %s', (_label, raw) => {
|
|
expect(safeDownloadName(raw)).toBe('photo');
|
|
});
|
|
|
|
it('never returns an empty name', () => {
|
|
for (const raw of ['///', QUOTE.repeat(3), '..', ' . ', NUL]) {
|
|
expect(safeDownloadName(raw).length).toBeGreaterThan(0);
|
|
}
|
|
});
|
|
|
|
it('bounds the length', () => {
|
|
expect(safeDownloadName('x'.repeat(5000)).length).toBeLessThanOrEqual(200);
|
|
});
|
|
});
|
|
|
|
describe('contentDisposition', () => {
|
|
it('marks the response as an attachment', () => {
|
|
expect(contentDisposition('DSCF1234.JPG')).toMatch(/^attachment; /);
|
|
});
|
|
|
|
it('carries both a plain and a percent-encoded filename', () => {
|
|
const header = contentDisposition('Fr\u00fchling.jpg');
|
|
expect(header).toContain('filename="Fr_hling.jpg"');
|
|
expect(header).toContain("filename*=UTF-8''Fr%C3%BChling.jpg");
|
|
});
|
|
|
|
it('never emits a control character, whatever it is given', () => {
|
|
expect(hasControlChar(contentDisposition(`a${CRLF}X-Evil: 1.jpg`))).toBe(false);
|
|
});
|
|
|
|
it('never emits an unbalanced quote', () => {
|
|
const header = contentDisposition(`a${QUOTE}b.jpg`);
|
|
expect((header.match(/"/g) ?? []).length % 2).toBe(0);
|
|
});
|
|
|
|
it('survives a missing name', () => {
|
|
expect(contentDisposition(undefined)).toContain('filename="photo"');
|
|
});
|
|
});
|