36 lines
1.4 KiB
JavaScript
36 lines
1.4 KiB
JavaScript
const test = require("node:test");
|
|
const assert = require("node:assert/strict");
|
|
const {
|
|
mapMulterError,
|
|
safeOriginalFilename,
|
|
} = require("../src/assets/multipart");
|
|
|
|
test("original filename metadata keeps a safe leaf without path traversal", () => {
|
|
assert.equal(safeOriginalFilename("../../Sunday/welcome.png"), "welcome.png");
|
|
assert.equal(safeOriginalFilename("..\\..\\Sunday\\welcome.png"), "welcome.png");
|
|
assert.equal(safeOriginalFilename(" welcome sign.png "), " welcome sign.png ");
|
|
});
|
|
|
|
test("original filename metadata removes controls and remains bounded", () => {
|
|
assert.equal(safeOriginalFilename("wel\u0000come\n.png"), "welcome.png");
|
|
assert.equal([...safeOriginalFilename(`${"a".repeat(300)}.png`)].length, 255);
|
|
assert.throws(
|
|
() => safeOriginalFilename(" \u0000\n "),
|
|
(error) => error.code === "INVALID_ORIGINAL_FILENAME",
|
|
);
|
|
});
|
|
|
|
test("temporary-storage failures are server errors, not invalid client uploads", () => {
|
|
const storageFailure = mapMulterError(
|
|
Object.assign(new Error("disk full at a private path"), { code: "ENOSPC" }),
|
|
{},
|
|
);
|
|
assert.equal(storageFailure.code, "UPLOAD_TEMP_STORAGE_UNAVAILABLE");
|
|
assert.equal(storageFailure.statusCode, 503);
|
|
assert.doesNotMatch(storageFailure.message, /private path/);
|
|
|
|
const malformed = mapMulterError(new Error("Unexpected end of form"), {});
|
|
assert.equal(malformed.code, "INVALID_MULTIPART_UPLOAD");
|
|
assert.equal(malformed.statusCode, 400);
|
|
});
|