47 lines
1.2 KiB
Go
47 lines
1.2 KiB
Go
|
package catalog
|
||
|
|
|
||
|
|
import (
|
||
|
|
"os"
|
||
|
|
"path/filepath"
|
||
|
|
"testing"
|
||
|
|
|
||
|
|
"github.com/google/uuid"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestResolveUploadPath(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
base := t.TempDir()
|
||
|
|
cid := uuid.New()
|
||
|
|
rel := cid.String() + "/sample.csv"
|
||
|
|
absWant := filepath.Join(base, filepath.FromSlash(rel))
|
||
|
|
if err := os.MkdirAll(filepath.Dir(absWant), 0o750); err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
if err := os.WriteFile(absWant, []byte("a,b\n1,2\n"), 0o640); err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
|
||
|
|
svc := &Service{}
|
||
|
|
got, err := svc.ResolveUploadPath(base, cid, rel)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("resolve: %v", err)
|
||
|
|
}
|
||
|
|
if filepath.Clean(got) != filepath.Clean(absWant) {
|
||
|
|
t.Fatalf("got %q want %q", got, absWant)
|
||
|
|
}
|
||
|
|
|
||
|
|
if _, err := svc.ResolveUploadPath("", cid, rel); err == nil {
|
||
|
|
t.Fatal("expected empty upload dir reject")
|
||
|
|
}
|
||
|
|
if _, err := svc.ResolveUploadPath(base, cid, "../etc/passwd"); err == nil {
|
||
|
|
t.Fatal("expected traversal reject")
|
||
|
|
}
|
||
|
|
if _, err := svc.ResolveUploadPath(base, cid, cid.String()+"/../outside.csv"); err == nil {
|
||
|
|
t.Fatal("expected nested traversal reject")
|
||
|
|
}
|
||
|
|
other := uuid.New()
|
||
|
|
if _, err := svc.ResolveUploadPath(base, cid, other.String()+"/x.csv"); err == nil {
|
||
|
|
t.Fatal("expected company mismatch reject")
|
||
|
|
}
|
||
|
|
}
|