|
@@ -5,10 +5,11 @@ const ot = require('..')
|
|
|
const safePathname = ot.safePathname
|
|
const safePathname = ot.safePathname
|
|
|
|
|
|
|
|
describe('safePathname', function () {
|
|
describe('safePathname', function () {
|
|
|
- function expectClean(input, output) {
|
|
|
|
|
|
|
+ function expectClean(input, output, reason = '') {
|
|
|
// check expected output and also idempotency
|
|
// check expected output and also idempotency
|
|
|
- const cleanedInput = safePathname.clean(input)
|
|
|
|
|
|
|
+ const [cleanedInput, gotReason] = safePathname.cleanDebug(input)
|
|
|
expect(cleanedInput).to.equal(output)
|
|
expect(cleanedInput).to.equal(output)
|
|
|
|
|
+ expect(gotReason).to.equal(reason)
|
|
|
expect(safePathname.clean(cleanedInput)).to.equal(cleanedInput)
|
|
expect(safePathname.clean(cleanedInput)).to.equal(cleanedInput)
|
|
|
expect(safePathname.isClean(cleanedInput)).to.be.true
|
|
expect(safePathname.isClean(cleanedInput)).to.be.true
|
|
|
}
|
|
}
|
|
@@ -22,44 +23,56 @@ describe('safePathname', function () {
|
|
|
expect(safePathname.isClean('rm -rf /')).to.be.falsy
|
|
expect(safePathname.isClean('rm -rf /')).to.be.falsy
|
|
|
|
|
|
|
|
// replace invalid characters with underscores
|
|
// replace invalid characters with underscores
|
|
|
- expectClean('test-s*\u0001\u0002m\u0007st\u0008.jpg', 'test-s___m_st_.jpg')
|
|
|
|
|
|
|
+ expectClean(
|
|
|
|
|
+ 'test-s*\u0001\u0002m\u0007st\u0008.jpg',
|
|
|
|
|
+ 'test-s___m_st_.jpg',
|
|
|
|
|
+ 'cleanPart'
|
|
|
|
|
+ )
|
|
|
|
|
|
|
|
// keep slashes, normalize paths, replace ..
|
|
// keep slashes, normalize paths, replace ..
|
|
|
- expectClean('./foo', 'foo')
|
|
|
|
|
- expectClean('../foo', '__/foo')
|
|
|
|
|
- expectClean('foo/./bar', 'foo/bar')
|
|
|
|
|
- expectClean('foo/../bar', 'bar')
|
|
|
|
|
- expectClean('../../tricky/foo.bar', '__/__/tricky/foo.bar')
|
|
|
|
|
- expectClean('foo/../../tricky/foo.bar', '__/tricky/foo.bar')
|
|
|
|
|
- expectClean('foo/bar/../../tricky/foo.bar', 'tricky/foo.bar')
|
|
|
|
|
- expectClean('foo/bar/baz/../../tricky/foo.bar', 'foo/tricky/foo.bar')
|
|
|
|
|
|
|
+ expectClean('./foo', 'foo', 'normalize')
|
|
|
|
|
+ expectClean('../foo', '__/foo', 'cleanPart')
|
|
|
|
|
+ expectClean('foo/./bar', 'foo/bar', 'normalize')
|
|
|
|
|
+ expectClean('foo/../bar', 'bar', 'normalize')
|
|
|
|
|
+ expectClean('../../tricky/foo.bar', '__/__/tricky/foo.bar', 'cleanPart')
|
|
|
|
|
+ expectClean(
|
|
|
|
|
+ 'foo/../../tricky/foo.bar',
|
|
|
|
|
+ '__/tricky/foo.bar',
|
|
|
|
|
+ 'normalize,cleanPart'
|
|
|
|
|
+ )
|
|
|
|
|
+ expectClean('foo/bar/../../tricky/foo.bar', 'tricky/foo.bar', 'normalize')
|
|
|
|
|
+ expectClean(
|
|
|
|
|
+ 'foo/bar/baz/../../tricky/foo.bar',
|
|
|
|
|
+ 'foo/tricky/foo.bar',
|
|
|
|
|
+ 'normalize'
|
|
|
|
|
+ )
|
|
|
|
|
|
|
|
// remove illegal chars even when there is no extension
|
|
// remove illegal chars even when there is no extension
|
|
|
- expectClean('**foo', '__foo')
|
|
|
|
|
|
|
+ expectClean('**foo', '__foo', 'cleanPart')
|
|
|
|
|
|
|
|
// remove windows file paths
|
|
// remove windows file paths
|
|
|
- expectClean('c:\\temp\\foo.txt', 'c:/temp/foo.txt')
|
|
|
|
|
|
|
+ expectClean('c:\\temp\\foo.txt', 'c:/temp/foo.txt', 'workaround for IE')
|
|
|
|
|
|
|
|
// do not allow a leading slash (relative paths only)
|
|
// do not allow a leading slash (relative paths only)
|
|
|
- expectClean('/foo', '_/foo')
|
|
|
|
|
- expectClean('//foo', '_/foo')
|
|
|
|
|
|
|
+ expectClean('/foo', '_/foo', 'no leading /')
|
|
|
|
|
+ expectClean('//foo', '_/foo', 'normalize,no leading /')
|
|
|
|
|
|
|
|
// do not allow multiple leading slashes
|
|
// do not allow multiple leading slashes
|
|
|
- expectClean('//foo', '_/foo')
|
|
|
|
|
|
|
+ expectClean('//foo', '_/foo', 'normalize,no leading /')
|
|
|
|
|
|
|
|
// do not allow a trailing slash
|
|
// do not allow a trailing slash
|
|
|
- expectClean('/', '_')
|
|
|
|
|
- expectClean('foo/', 'foo')
|
|
|
|
|
- expectClean('foo.tex/', 'foo.tex')
|
|
|
|
|
|
|
+ expectClean('/', '_', 'no leading /,no trailing /')
|
|
|
|
|
+ expectClean('foo/', 'foo', 'no trailing /')
|
|
|
|
|
+ expectClean('foo.tex/', 'foo.tex', 'no trailing /')
|
|
|
|
|
|
|
|
// do not allow multiple trailing slashes
|
|
// do not allow multiple trailing slashes
|
|
|
- expectClean('//', '_')
|
|
|
|
|
- expectClean('///', '_')
|
|
|
|
|
- expectClean('foo//', 'foo')
|
|
|
|
|
|
|
+ expectClean('//', '_', 'normalize,no leading /,no trailing /')
|
|
|
|
|
+ expectClean('///', '_', 'normalize,no leading /,no trailing /')
|
|
|
|
|
+ expectClean('foo//', 'foo', 'normalize,no trailing /')
|
|
|
|
|
|
|
|
// file and folder names that consist of . and .. are not OK
|
|
// file and folder names that consist of . and .. are not OK
|
|
|
- expectClean('.', '_')
|
|
|
|
|
- expectClean('..', '__')
|
|
|
|
|
|
|
+ expectClean('.', '_', 'cleanPart')
|
|
|
|
|
+ expectClean('..', '__', 'cleanPart')
|
|
|
// we will allow name with more dots e.g. ... and ....
|
|
// we will allow name with more dots e.g. ... and ....
|
|
|
expectClean('...', '...')
|
|
expectClean('...', '...')
|
|
|
expectClean('....', '....')
|
|
expectClean('....', '....')
|
|
@@ -82,10 +95,10 @@ describe('safePathname', function () {
|
|
|
expectClean('a b.png', 'a b.png')
|
|
expectClean('a b.png', 'a b.png')
|
|
|
|
|
|
|
|
// leading and trailing spaces are not OK
|
|
// leading and trailing spaces are not OK
|
|
|
- expectClean(' foo', 'foo')
|
|
|
|
|
- expectClean(' foo', 'foo')
|
|
|
|
|
- expectClean('foo ', 'foo')
|
|
|
|
|
- expectClean('foo ', 'foo')
|
|
|
|
|
|
|
+ expectClean(' foo', 'foo', 'no leading spaces')
|
|
|
|
|
+ expectClean(' foo', 'foo', 'no leading spaces')
|
|
|
|
|
+ expectClean('foo ', 'foo', 'no trailing spaces')
|
|
|
|
|
+ expectClean('foo ', 'foo', 'no trailing spaces')
|
|
|
|
|
|
|
|
// reserved file names on Windows should not be OK, but we already have
|
|
// reserved file names on Windows should not be OK, but we already have
|
|
|
// some in the old system, so have to allow them for now
|
|
// some in the old system, so have to allow them for now
|
|
@@ -100,14 +113,14 @@ describe('safePathname', function () {
|
|
|
// there's no particular reason to allow multiple slashes; sometimes people
|
|
// there's no particular reason to allow multiple slashes; sometimes people
|
|
|
// seem to rename files to URLs (https://domain/path) in an attempt to
|
|
// seem to rename files to URLs (https://domain/path) in an attempt to
|
|
|
// upload a file, and this results in an empty directory name
|
|
// upload a file, and this results in an empty directory name
|
|
|
- expectClean('foo//bar.png', 'foo/bar.png')
|
|
|
|
|
- expectClean('foo///bar.png', 'foo/bar.png')
|
|
|
|
|
|
|
+ expectClean('foo//bar.png', 'foo/bar.png', 'normalize')
|
|
|
|
|
+ expectClean('foo///bar.png', 'foo/bar.png', 'normalize')
|
|
|
|
|
|
|
|
// Check javascript property handling
|
|
// Check javascript property handling
|
|
|
expectClean('foo/prototype', 'foo/prototype') // OK as part of a pathname
|
|
expectClean('foo/prototype', 'foo/prototype') // OK as part of a pathname
|
|
|
expectClean('prototype/test.txt', 'prototype/test.txt')
|
|
expectClean('prototype/test.txt', 'prototype/test.txt')
|
|
|
- expectClean('prototype', '@prototype') // not OK as whole pathname
|
|
|
|
|
- expectClean('hasOwnProperty', '@hasOwnProperty')
|
|
|
|
|
- expectClean('**proto**', '@__proto__')
|
|
|
|
|
|
|
+ expectClean('prototype', '@prototype', 'BLOCKED_FILE_RX') // not OK as whole pathname
|
|
|
|
|
+ expectClean('hasOwnProperty', '@hasOwnProperty', 'BLOCKED_FILE_RX')
|
|
|
|
|
+ expectClean('**proto**', '@__proto__', 'cleanPart,BLOCKED_FILE_RX')
|
|
|
})
|
|
})
|
|
|
})
|
|
})
|