strip \r and \r from content-disposition filenames
[akkoma] / test / pleroma / web / plugs / uploaded_media_plug_test.exs
1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
4
5 defmodule Pleroma.Web.Plugs.UploadedMediaPlugTest do
6 use Pleroma.Web.ConnCase, async: true
7 alias Pleroma.Upload
8
9 defp upload_file(context) do
10 Pleroma.DataCase.ensure_local_uploader(context)
11 File.cp!("test/fixtures/image.jpg", "test/fixtures/image_tmp.jpg")
12
13 file = %Plug.Upload{
14 content_type: "image/jpeg",
15 path: Path.absname("test/fixtures/image_tmp.jpg"),
16 filename: "nice_tf.jpg"
17 }
18
19 {:ok, data} = Upload.store(file)
20 [%{"href" => attachment_url} | _] = data["url"]
21 [attachment_url: attachment_url]
22 end
23
24 setup_all :upload_file
25
26 test "does not send Content-Disposition header when name param is not set", %{
27 attachment_url: attachment_url
28 } do
29 conn = get(build_conn(), attachment_url)
30 refute Enum.any?(conn.resp_headers, &(elem(&1, 0) == "content-disposition"))
31 end
32
33 test "sends Content-Disposition header when name param is set", %{
34 attachment_url: attachment_url
35 } do
36 conn = get(build_conn(), attachment_url <> "?name=\"cofe\".gif")
37
38 assert Enum.any?(
39 conn.resp_headers,
40 &(&1 == {"content-disposition", "filename=\"\\\"cofe\\\".gif\""})
41 )
42 end
43
44 test "removes control characters from the Content-Disposition header", %{
45 attachment_url: attachment_url
46 } do
47 conn = get(build_conn(), attachment_url <> "?name=\"cofe\".gif\\r\\n")
48
49 assert Enum.any?(
50 conn.resp_headers,
51 &(&1 == {"content-disposition", "filename=\"\\\"cofe\\\".gif\""})
52 )
53 end
54 end