120 lines
3.7 KiB
Go
120 lines
3.7 KiB
Go
// 功能描述：报修上传的内容幂等、格式、跨账户和路径边界回归。
|
||
// 版本：1.0.0。
|
||
package upload
|
||
|
||
import (
|
||
"bytes"
|
||
"encoding/json"
|
||
"github.com/gin-gonic/gin"
|
||
"mime/multipart"
|
||
"net/http/httptest"
|
||
"path"
|
||
"strings"
|
||
"testing"
|
||
)
|
||
|
||
func uploadPhotoForTest(t *testing.T, owner, filename string, content []byte) (string, int) {
|
||
t.Helper()
|
||
var body bytes.Buffer
|
||
writer := multipart.NewWriter(&body)
|
||
part, err := writer.CreateFormFile("file", filename)
|
||
if err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
part.Write(content)
|
||
writer.Close()
|
||
response := httptest.NewRecorder()
|
||
ctx, _ := gin.CreateTestContext(response)
|
||
ctx.Request = httptest.NewRequest("POST", "/ticket-photos", &body)
|
||
ctx.Request.Header.Set("Content-Type", writer.FormDataContentType())
|
||
UploadTicketPhoto(ctx, owner)
|
||
var result struct {
|
||
Code int `json:"code"`
|
||
Details json.RawMessage `json:"details"`
|
||
}
|
||
if err := json.Unmarshal(response.Body.Bytes(), &result); err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
var details struct {
|
||
URI string `json:"uri"`
|
||
}
|
||
if result.Code == 0 {
|
||
if err := json.Unmarshal(result.Details, &details); err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
}
|
||
return details.URI, result.Code
|
||
}
|
||
|
||
// TestDraftPhotoRead 验证草稿读取只能访问当前账户已上传的文件名。
|
||
func TestDraftPhotoRead(t *testing.T) {
|
||
t.Setenv("HEQI_UPLOAD_DIR", t.TempDir())
|
||
picture := pngBytes(t, 2, 2)
|
||
uri, code := uploadPhotoForTest(t, "alice", "image.png", picture)
|
||
if code != 0 {
|
||
t.Fatal("上传失败", code)
|
||
}
|
||
for _, scenario := range []struct {
|
||
owner, name string
|
||
status int
|
||
}{
|
||
{"alice", path.Base(uri), 200},
|
||
{"bob", path.Base(uri), 404},
|
||
{"alice", "../" + path.Base(uri), 404},
|
||
{"alice", "unknown.png", 404},
|
||
} {
|
||
response := httptest.NewRecorder()
|
||
ctx, _ := gin.CreateTestContext(response)
|
||
ctx.Request = httptest.NewRequest("GET", "/ticket-photos/file", nil)
|
||
ServeOwnedTicketPhoto(ctx, scenario.owner, scenario.name)
|
||
ctx.Writer.WriteHeaderNow()
|
||
if response.Code != scenario.status {
|
||
t.Fatalf("%s: 状态 %d", scenario.owner, response.Code)
|
||
}
|
||
if scenario.status == 200 && !bytes.Equal(response.Body.Bytes(), picture) {
|
||
t.Fatal("图片内容不一致")
|
||
}
|
||
}
|
||
}
|
||
|
||
func TestTicketPhotoStorage(t *testing.T) {
|
||
t.Setenv("HEQI_UPLOAD_DIR", t.TempDir())
|
||
picture := pngBytes(t, 2, 2)
|
||
first, code := uploadPhotoForTest(t, "alice", "image.png", picture)
|
||
if code != 0 || !OwnsTicketPhoto("alice", first) {
|
||
t.Fatal("上传失败", code)
|
||
}
|
||
second, code := uploadPhotoForTest(t, "alice", "other.png", picture)
|
||
if code != 0 || first != second {
|
||
t.Fatal("重复上传未复用")
|
||
}
|
||
if OwnsTicketPhoto("bob", first) {
|
||
t.Fatal("跨账户引用")
|
||
}
|
||
for _, uri := range []string{first + "/../secret.png", strings.ReplaceAll(first, "/", "\\"), "https://example.com/a.png", "/uploads/avatars/a.png"} {
|
||
if OwnsTicketPhoto("alice", uri) {
|
||
t.Fatal("非法路径", uri)
|
||
}
|
||
}
|
||
for _, data := range [][]byte{[]byte("fake"), pngBytes(t, 4097, 1), make([]byte, (2<<20)+1)} {
|
||
if _, code := uploadPhotoForTest(t, "alice", "x.png", data); code == 0 {
|
||
t.Fatal("错误图片被接受")
|
||
}
|
||
}
|
||
response := httptest.NewRecorder()
|
||
ctx, _ := gin.CreateTestContext(response)
|
||
ctx.Request = httptest.NewRequest("GET", "/photo", nil)
|
||
ServeTicketPhoto(ctx, "alice", first)
|
||
if response.Code != 200 || response.Header().Get("Cache-Control") != "private, no-store" || !bytes.Equal(response.Body.Bytes(), picture) {
|
||
t.Fatal("读取或缓存保护失败")
|
||
}
|
||
response = httptest.NewRecorder()
|
||
ctx, _ = gin.CreateTestContext(response)
|
||
ctx.Request = httptest.NewRequest("GET", "/photo", nil)
|
||
ServeTicketPhoto(ctx, "bob", first)
|
||
ctx.Writer.WriteHeaderNow()
|
||
if response.Code != 404 {
|
||
t.Fatal("越权读取")
|
||
}
|
||
}
|