mirror of
https://github.com/outline/outline.git
synced 2026-06-13 11:25:03 +03:00
Tom Moor
adbffc0734
* chore: clear mechanical lint warnings Drops 44 oxlint warnings (559 → 515) by fixing easy mechanical rules across the codebase: no-useless-escape, no-duplicate-type-constituents, no-redundant-type-constituents, no-unused-expressions, no-meaningless-void-operator, require-array-sort-compare, await-thenable. * chore: drop callback parameter from useCallback deps The `open` argument is a parameter of the callback, not a closed-over variable, so it doesn't belong in the deps array. * chore: promote cleared lint rules to errors Promotes the rules cleared in this PR from warn to error so future violations fail the lint: - no-unused-expressions - typescript/await-thenable - typescript/no-duplicate-type-constituents - typescript/no-meaningless-void-operator - typescript/require-array-sort-compare Removes the override that suppressed no-useless-escape on source files (the global rule is already error) and fixes the 21 escape violations that this exposed in regex character classes and template literals. * chore: address PR review feedback - usePinnedDocuments: simplify UrlId to plain string instead of the intersection trick. - PlantUML embed: move - to end of character class so it's a literal hyphen rather than a range operator. - checkboxes: type token params as Token | undefined to match the actual call sites that pass tokens[index - 2] etc.
71 lines
2.1 KiB
TypeScript
71 lines
2.1 KiB
TypeScript
import { randomUUID } from "node:crypto";
|
|
import { Buckets } from "./models/helpers/AttachmentHelper";
|
|
import { ValidateKey } from "./validation";
|
|
|
|
describe("#ValidateKey.isValid", () => {
|
|
it("should return false if number of key components is incorrect", () => {
|
|
expect(
|
|
ValidateKey.isValid(
|
|
`${Buckets.uploads}/${randomUUID()}/${randomUUID()}/foo/bar`
|
|
)
|
|
).toBe(false);
|
|
});
|
|
|
|
it("should return false if the first key component is not a valid bucket", () => {
|
|
expect(
|
|
ValidateKey.isValid(`foo/${randomUUID()}/${randomUUID()}/bar.png`)
|
|
).toBe(false);
|
|
});
|
|
|
|
it("should return false if second and third key components are not UUID", () => {
|
|
expect(
|
|
ValidateKey.isValid(`${Buckets.uploads}/foo/${randomUUID()}/bar.png`)
|
|
).toBe(false);
|
|
expect(
|
|
ValidateKey.isValid(`${Buckets.uploads}/${randomUUID()}/foo/bar.png`)
|
|
).toBe(false);
|
|
});
|
|
|
|
it("should return true successfully validating key", () => {
|
|
expect(
|
|
ValidateKey.isValid(
|
|
`${Buckets.public}/${randomUUID()}/${randomUUID()}/foo.png`
|
|
)
|
|
).toBe(true);
|
|
expect(
|
|
ValidateKey.isValid(
|
|
`${Buckets.uploads}/${randomUUID()}/${randomUUID()}/foo.png`
|
|
)
|
|
).toBe(true);
|
|
expect(
|
|
ValidateKey.isValid(`${Buckets.avatars}/${randomUUID()}/${randomUUID()}`)
|
|
).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe("#ValidateKey.sanitize", () => {
|
|
it("should sanitize malicious looking keys", () => {
|
|
const uuid1 = randomUUID();
|
|
const uuid2 = randomUUID();
|
|
expect(
|
|
ValidateKey.sanitize(`public/${uuid1}/${uuid2}/~.\u0000malicious_key`)
|
|
).toEqual(`public/${uuid1}/${uuid2}/~.malicious_key`);
|
|
});
|
|
|
|
it("should remove potential path traversal", () => {
|
|
const uuid1 = randomUUID();
|
|
const uuid2 = randomUUID();
|
|
expect(
|
|
ValidateKey.sanitize(`public/${uuid1}/${uuid2}/../../malicious_key`)
|
|
).toEqual(`public/${uuid1}/${uuid2}/malicious_key`);
|
|
});
|
|
|
|
it("should remove problematic characters", () => {
|
|
const uuid1 = randomUUID();
|
|
const uuid2 = randomUUID();
|
|
expect(ValidateKey.sanitize(`public/${uuid1}/${uuid2}/test#:*?`)).toEqual(
|
|
`public/${uuid1}/${uuid2}/test`
|
|
);
|
|
});
|
|
});
|