71 lines
2.3 KiB
Go
71 lines
2.3 KiB
Go
|
// Package upload 测试头像上传的格式、尺寸与路径安全边界。
|
|||
|
|
// 版本：v1.0.0
|
|||
|
|
package upload
|
|||
|
|
|
|||
|
|
import (
|
|||
|
|
"bytes"
|
|||
|
|
"image"
|
|||
|
|
"image/color"
|
|||
|
|
"image/png"
|
|||
|
|
"path/filepath"
|
|||
|
|
"strings"
|
|||
|
|
"testing"
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
// pngBytes 生成指定尺寸的有效 PNG 测试图片。
|
|||
|
|
func pngBytes(t *testing.T, width, height int) []byte {
|
|||
|
|
t.Helper()
|
|||
|
|
picture := image.NewRGBA(image.Rect(0, 0, width, height))
|
|||
|
|
picture.Set(0, 0, color.RGBA{R: 32, G: 96, B: 192, A: 255})
|
|||
|
|
var buffer bytes.Buffer
|
|||
|
|
if err := png.Encode(&buffer, picture); err != nil {
|
|||
|
|
t.Fatalf("encode PNG: %v", err)
|
|||
|
|
}
|
|||
|
|
return buffer.Bytes()
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// TestValidateAvatarAcceptsRealPNG 验证真实 PNG 可通过并规范化类型。
|
|||
|
|
func TestValidateAvatarAcceptsRealPNG(t *testing.T) {
|
|||
|
|
extension, contentType, err := validateAvatar("头像.PNG", pngBytes(t, 2, 2))
|
|||
|
|
if err != nil {
|
|||
|
|
t.Fatalf("valid PNG was rejected: %v", err)
|
|||
|
|
}
|
|||
|
|
if extension != ".png" || contentType != "image/png" {
|
|||
|
|
t.Fatalf("avatar metadata = (%q, %q)", extension, contentType)
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// TestValidateAvatarRejectsSpoofedAndOversizedImage 验证伪造扩展名与超大像素尺寸会被拒绝。
|
|||
|
|
func TestValidateAvatarRejectsSpoofedAndOversizedImage(t *testing.T) {
|
|||
|
|
if _, _, err := validateAvatar("fake.png", []byte("not an image")); err == nil {
|
|||
|
|
t.Fatal("spoofed PNG was accepted")
|
|||
|
|
}
|
|||
|
|
if _, _, err := validateAvatar("wide.png", pngBytes(t, maxAvatarDimension+1, 1)); err == nil {
|
|||
|
|
t.Fatal("oversized image dimensions were accepted")
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// TestAvatarPathFromURIStaysInsideControlledRoot 验证头像 URI 不能逃逸受控目录。
|
|||
|
|
func TestAvatarPathFromURIStaysInsideControlledRoot(t *testing.T) {
|
|||
|
|
root := t.TempDir()
|
|||
|
|
t.Setenv("HEQI_UPLOAD_DIR", root)
|
|||
|
|
path, err := avatarPathFromURI("/uploads/avatars/2026/08/10/example.png")
|
|||
|
|
if err != nil {
|
|||
|
|
t.Fatalf("controlled URI was rejected: %v", err)
|
|||
|
|
}
|
|||
|
|
expectedRoot := filepath.Join(root, "avatars")
|
|||
|
|
relative, err := filepath.Rel(expectedRoot, path)
|
|||
|
|
if err != nil || relative == ".." || strings.HasPrefix(relative, ".."+string(filepath.Separator)) {
|
|||
|
|
t.Fatalf("avatar path escaped root: %q", path)
|
|||
|
|
}
|
|||
|
|
for _, uri := range []string{
|
|||
|
|
"https://example.com/avatar.png",
|
|||
|
|
"/uploads/example.png",
|
|||
|
|
"/uploads/avatars/../../secret.png",
|
|||
|
|
} {
|
|||
|
|
if _, err := avatarPathFromURI(uri); err == nil {
|
|||
|
|
t.Fatalf("unsafe avatar URI was accepted: %q", uri)
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|