37 lines
1.3 KiB
TypeScript
37 lines
1.3 KiB
TypeScript
import { expect, test } from "bun:test";
|
|
import { mkdtempSync } from "node:fs";
|
|
import { tmpdir } from "node:os";
|
|
import { join } from "node:path";
|
|
import { configureStorage, getStore, serveStoredFile, upload } from "../src/index.ts";
|
|
|
|
function configure() {
|
|
configureStorage(
|
|
{ stores: { public: { driver: "local", access: "public", dir: "files" } } },
|
|
mkdtempSync(join(tmpdir(), "wrnexus-upload-")),
|
|
);
|
|
}
|
|
|
|
test("rejects unsafe upload prefixes before writing", async () => {
|
|
configure();
|
|
const form = new FormData();
|
|
form.set("file", new File(["hello"], "hello.txt", { type: "text/plain" }));
|
|
const request = new Request("http://local/upload", { method: "POST", body: form });
|
|
await expect(upload("public", request, { prefix: "../escape" })).rejects.toThrow(
|
|
"unsafe upload prefix",
|
|
);
|
|
});
|
|
|
|
test("public active content is attachment-only and cannot be MIME-sniffed", async () => {
|
|
configure();
|
|
await getStore("public").driver.put(
|
|
"safe/page.html",
|
|
new TextEncoder().encode("<script>x</script>"),
|
|
{
|
|
contentType: "text/html",
|
|
},
|
|
);
|
|
const response = await serveStoredFile("/__wrnexus/uploads/public/safe/page.html");
|
|
expect(response?.headers.get("x-content-type-options")).toBe("nosniff");
|
|
expect(response?.headers.get("content-disposition")).toStartWith("attachment");
|
|
});
|