first commit

2026-07-12 15:55:18 +05:30
commit ee98026cc5
404 changed files with 44522 additions and 0 deletions
@@ -0,0 +1,36 @@
+import { expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { configureStorage, getStore, serveStoredFile, upload } from "../src/index.ts";
+
+function configure() {
+  configureStorage(
+    { stores: { public: { driver: "local", access: "public", dir: "files" } } },
+    mkdtempSync(join(tmpdir(), "wrnexus-upload-")),
+  );
+}
+
+test("rejects unsafe upload prefixes before writing", async () => {
+  configure();
+  const form = new FormData();
+  form.set("file", new File(["hello"], "hello.txt", { type: "text/plain" }));
+  const request = new Request("http://local/upload", { method: "POST", body: form });
+  await expect(upload("public", request, { prefix: "../escape" })).rejects.toThrow(
+    "unsafe upload prefix",
+  );
+});
+
+test("public active content is attachment-only and cannot be MIME-sniffed", async () => {
+  configure();
+  await getStore("public").driver.put(
+    "safe/page.html",
+    new TextEncoder().encode("<script>x</script>"),
+    {
+      contentType: "text/html",
+    },
+  );
+  const response = await serveStoredFile("/__wrnexus/uploads/public/safe/page.html");
+  expect(response?.headers.get("x-content-type-options")).toBe("nosniff");
+  expect(response?.headers.get("content-disposition")).toStartWith("attachment");
+});