44 lines
1.3 KiB
Go
44 lines
1.3 KiB
Go
package main
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/golang/mock/gomock"
|
|
"github.com/tinode/chat/server/store"
|
|
"github.com/tinode/chat/server/store/mock_store"
|
|
"github.com/tinode/chat/server/store/types"
|
|
)
|
|
|
|
func TestAuthorizeLargeFileDownloadDenied(t *testing.T) {
|
|
ctrl := gomock.NewController(t)
|
|
defer ctrl.Finish()
|
|
oldFiles := store.Files
|
|
files := mock_store.NewMockFilePersistenceInterface(ctrl)
|
|
store.Files = files
|
|
defer func() { store.Files = oldFiles }()
|
|
|
|
fd := &types.FileDef{
|
|
ObjHeader: types.ObjHeader{Id: types.Uid(100).String(), UpdatedAt: time.Date(2026, 8, 13, 9, 0, 0, 0, time.UTC)},
|
|
TenantID: 7,
|
|
Status: types.UploadCompleted,
|
|
MimeType: "text/plain",
|
|
Location: "notes.txt",
|
|
}
|
|
files.EXPECT().UserHasAccess(types.TenantID(7), types.Uid(100).String(), types.Uid(42)).Return(false, nil)
|
|
if err := authorizeLargeFileDownload(7, 42, "", fd); err != types.ErrPermissionDenied {
|
|
t.Fatalf("expected permission denied, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestContentDispositionAttachmentSanitizesName(t *testing.T) {
|
|
fd := &types.FileDef{
|
|
ObjHeader: types.ObjHeader{Id: types.Uid(100).String()},
|
|
Location: `../bad"name.txt`,
|
|
}
|
|
got := contentDispositionAttachment(fd)
|
|
if got != `attachment; filename=badname.txt` {
|
|
t.Fatalf("unexpected content disposition: %s", got)
|
|
}
|
|
}
|