0ec62acb9d
This actually was already intended before to eradict all future path-traversal-style exploits and to fix issues with some characters like akkoma#610 in0b2ec0ccee. However, Dedupe and AnonymizeFilename got mixed up. The latter only anonymises the name in Content-Disposition headers GET parameters (with link_name), _not_ the upload path. Even without Dedupe, the upload path is prefixed by an UUID, so it _should_ already be hard to guess for attackers. But now we actually can be sure no path shenanigangs occur, uploads reliably work and save some disk space. While this makes the final path predictable, this prediction is not exploitable. Insertion of a back-reference to the upload itself requires pulling off a successfull preimage attack against SHA-256, which is deemed infeasible for the foreseeable futures. Dedupe was already included in the default list in config.exs since28cfb2c37a, but this will get overridde by whatever the config generated by the "pleroma.instance gen" task chose. Upload+delete tests running in parallel using Dedupe might be flaky, but this was already true before and needs its own commit to fix eventually.
81 lines
2.3 KiB
Elixir
81 lines
2.3 KiB
Elixir
# Pleroma: A lightweight social networking server
|
|
# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
defmodule Pleroma.Web.PleromaAPI.MascotControllerTest do
|
|
use Pleroma.Web.ConnCase, async: false
|
|
|
|
alias Pleroma.User
|
|
|
|
setup do
|
|
clear_config([Pleroma.Upload, :uploader], Pleroma.Uploaders.Local)
|
|
end
|
|
|
|
test "mascot upload" do
|
|
%{conn: conn} = oauth_access(["write:accounts"])
|
|
|
|
non_image_file = %Plug.Upload{
|
|
content_type: "audio/mpeg",
|
|
path: Path.absname("test/fixtures/sound.mp3"),
|
|
filename: "sound.mp3"
|
|
}
|
|
|
|
ret_conn =
|
|
conn
|
|
|> put_req_header("content-type", "multipart/form-data")
|
|
|> put("/api/v1/pleroma/mascot", %{"file" => non_image_file})
|
|
|
|
assert json_response_and_validate_schema(ret_conn, 415)
|
|
|
|
file = %Plug.Upload{
|
|
content_type: "image/jpeg",
|
|
path: Path.absname("test/fixtures/image.jpg"),
|
|
filename: "an_image.jpg"
|
|
}
|
|
|
|
conn =
|
|
conn
|
|
|> put_req_header("content-type", "multipart/form-data")
|
|
|> put("/api/v1/pleroma/mascot", %{"file" => file})
|
|
|
|
assert %{"id" => _, "type" => _image} = json_response_and_validate_schema(conn, 200)
|
|
end
|
|
|
|
test "mascot retrieving" do
|
|
%{user: user, conn: conn} = oauth_access(["read:accounts", "write:accounts"])
|
|
|
|
# When user hasn't set a mascot, we should just get pleroma tan back
|
|
ret_conn = get(conn, "/api/v1/pleroma/mascot")
|
|
|
|
assert %{"url" => url} = json_response_and_validate_schema(ret_conn, 200)
|
|
assert url =~ "pleroma-fox-tan-smol"
|
|
|
|
# When a user sets their mascot, we should get that back
|
|
file = %Plug.Upload{
|
|
content_type: "image/jpeg",
|
|
path: Path.absname("test/fixtures/image.jpg"),
|
|
filename: "an_image.jpg"
|
|
}
|
|
|
|
ret_conn =
|
|
conn
|
|
|> put_req_header("content-type", "multipart/form-data")
|
|
|> put("/api/v1/pleroma/mascot", %{"file" => file})
|
|
|
|
assert json_response_and_validate_schema(ret_conn, 200)
|
|
|
|
%{"url" => uploaded_url} = Jason.decode!(ret_conn.resp_body)
|
|
|
|
assert uploaded_url != nil and is_binary(uploaded_url)
|
|
|
|
user = User.get_cached_by_id(user.id)
|
|
|
|
conn =
|
|
conn
|
|
|> assign(:user, user)
|
|
|> get("/api/v1/pleroma/mascot")
|
|
|
|
assert %{"url" => url, "type" => "image"} = json_response_and_validate_schema(conn, 200)
|
|
assert url == uploaded_url
|
|
end
|
|
end
|