weichenandCursor
6bc238c665
Centralize template extension, magic-byte, and HTML/script rejection in upload.ValidateTemplate so admin template POST matches project asset hardening. Co-authored-by: Cursor <cursoragent@cursor.com>
77 lines
2.1 KiB
Go
77 lines
2.1 KiB
Go
package upload
|
|
|
|
import (
|
|
"testing"
|
|
)
|
|
|
|
func TestValidateProjectMaterial_AcceptsPlainText(t *testing.T) {
|
|
mime, err := ValidateProjectMaterial("spec.txt", "text/plain", []byte("hello material"))
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
if mime != "text/plain" {
|
|
t.Fatalf("mime=%s", mime)
|
|
}
|
|
}
|
|
|
|
func TestValidateProjectMaterial_RejectsHTML(t *testing.T) {
|
|
data := []byte("<html><script>alert(1)</script></html>")
|
|
_, err := ValidateProjectMaterial("evil.txt", "text/html", data)
|
|
if err == nil {
|
|
t.Fatal("expected rejection for html content")
|
|
}
|
|
}
|
|
|
|
func TestValidateProjectMaterial_RejectsBadExtension(t *testing.T) {
|
|
_, err := ValidateProjectMaterial("malware.exe", "application/octet-stream", []byte("MZ"))
|
|
if err == nil {
|
|
t.Fatal("expected rejection for exe extension")
|
|
}
|
|
}
|
|
|
|
func TestValidateProjectMaterial_RejectsPDFMagicMismatch(t *testing.T) {
|
|
_, err := ValidateProjectMaterial("fake.pdf", "application/pdf", []byte("not a pdf"))
|
|
if err == nil {
|
|
t.Fatal("expected pdf magic rejection")
|
|
}
|
|
}
|
|
|
|
func TestValidateProjectMaterial_AcceptsPDF(t *testing.T) {
|
|
_, err := ValidateProjectMaterial("doc.pdf", "", []byte("%PDF-1.4\n"))
|
|
if err != nil {
|
|
t.Fatalf("pdf: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestValidateTemplate_AcceptsMarkdown(t *testing.T) {
|
|
mime, err := ValidateTemplate("brief.md", "text/markdown", []byte("# Title\n\nBody"))
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
if mime != "text/markdown" {
|
|
t.Fatalf("mime=%s", mime)
|
|
}
|
|
}
|
|
|
|
func TestValidateTemplate_RejectsHTML(t *testing.T) {
|
|
data := []byte("<html><script>alert(1)</script></html>")
|
|
_, err := ValidateTemplate("evil.md", "text/markdown", data)
|
|
if err == nil {
|
|
t.Fatal("expected rejection for html content")
|
|
}
|
|
}
|
|
|
|
func TestValidateTemplate_RejectsFakeOfficeDoc(t *testing.T) {
|
|
_, err := ValidateTemplate("fake.docx", "", []byte("not a zip"))
|
|
if err == nil {
|
|
t.Fatal("expected office magic rejection")
|
|
}
|
|
}
|
|
|
|
func TestValidateTemplate_AcceptsOfficeZipMagic(t *testing.T) {
|
|
_, err := ValidateTemplate("deck.pptx", "", []byte("PK\x03\x04fake-pptx"))
|
|
if err != nil {
|
|
t.Fatalf("pptx: %v", err)
|
|
}
|
|
}
|