Janady13/missionmatch / internal/modules/org/service_test.go

1package org 2 3import ( 4 "bytes" 5 "encoding/base64" 6 "image" 7 "image/color" 8 "image/jpeg" 9 "image/png" 10 "strings" 11 "testing" 12) 13 14// pngOf builds a real PNG of the requested size so the tests exercise the actual decoder rather than a 15// fixture that might drift from what the decoder accepts. 16func pngOf(t *testing.T, w, h int) []byte { 17 t.Helper() 18 img := image.NewRGBA(image.Rect(0, 0, w, h)) 19 img.Set(0, 0, color.RGBA{R: 1, G: 2, B: 3, A: 255}) 20 var buf bytes.Buffer 21 if err := png.Encode(&buf, img); err != nil { 22 t.Fatalf("encode png: %v", err) 23 } 24 return buf.Bytes() 25} 26 27func jpegOf(t *testing.T, w, h int) []byte { 28 t.Helper() 29 img := image.NewRGBA(image.Rect(0, 0, w, h)) 30 var buf bytes.Buffer 31 if err := jpeg.Encode(&buf, img, nil); err != nil { 32 t.Fatalf("encode jpeg: %v", err) 33 } 34 return buf.Bytes() 35} 36 37// validate mirrors exactly what SetLogo does before it touches the database, so these tests can prove the 38// validation without a pool. If SetLogo changes, this must change with it. 39func validate(raw []byte) error { 40 if len(raw) == 0 { 41 return ErrLogoFormat 42 } 43 if len(raw) > MaxLogoBytes { 44 return ErrLogoTooLarge 45 } 46 cfg, format, err := image.DecodeConfig(bytes.NewReader(raw)) 47 if err != nil { 48 return ErrLogoFormat 49 } 50 if _, ok := formatMIME[format]; !ok { 51 return ErrLogoFormat 52 } 53 if cfg.Width <= 0 || cfg.Height <= 0 || cfg.Width > MaxLogoDimension || cfg.Height > MaxLogoDimension { 54 return ErrLogoTooBig 55 } 56 return nil 57} 58 59// TestRealImagesAreAccepted. Both permitted formats must round trip. 60func TestRealImagesAreAccepted(t *testing.T) { 61 if err := validate(pngOf(t, 64, 64)); err != nil { 62 t.Errorf("a real png was rejected: %v", err) 63 } 64 if err := validate(jpegOf(t, 64, 64)); err != nil { 65 t.Errorf("a real jpeg was rejected: %v", err) 66 } 67} 68 69// TestHostileUploadsAreRejected is the security proof. Every case here is a real attack shape: a payload 70// whose declared type or file extension claims one thing while the bytes are something else. The server 71// never trusts the declared type, so all of them must fail on content. 72func TestHostileUploadsAreRejected(t *testing.T) { 73 cases := []struct { 74 name string 75 body []byte 76 }{ 77 { 78 // The important one. An SVG served from the application origin can carry a script element and 79 // become stored cross site scripting against every user in the organization. 80 name: "svg with a script payload", 81 body: []byte(`<svg xmlns="http://www.w3.org/2000/svg"><script>alert(document.cookie)</script></svg>`), 82 }, 83 { 84 name: "html document renamed to an image", 85 body: []byte(`<html><body><script>fetch('/api/candidates')</script></body></html>`), 86 }, 87 { 88 // A polyglot: valid PNG magic bytes followed by markup, betting the server checks only the 89 // first eight bytes. DecodeConfig parses the header structure, so a truncated PNG fails. 90 name: "png magic bytes then html", 91 body: append([]byte{0x89, 'P', 'N', 'G', 0x0d, 0x0a, 0x1a, 0x0a}, []byte(`<script>alert(1)</script>`)...), 92 }, 93 {name: "empty body", body: []byte{}}, 94 {name: "plain text", body: []byte("not an image at all")}, 95 { 96 name: "gif is a real image but is not permitted", 97 body: mustDecodeB64(t, "R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"), 98 }, 99 } 100 for _, c := range cases { 101 t.Run(c.name, func(t *testing.T) { 102 if err := validate(c.body); err == nil { 103 t.Fatalf("%s was ACCEPTED, it must be rejected", c.name) 104 } 105 }) 106 } 107} 108 109// TestOversizeIsRejectedBeforeDecoding proves the cheap length check runs first, so a hostile upload 110// never reaches the decoder. 111func TestOversizeIsRejectedBeforeDecoding(t *testing.T) { 112 big := make([]byte, MaxLogoBytes+1) 113 if err := validate(big); err != ErrLogoTooLarge { 114 t.Errorf("oversize error = %v, want ErrLogoTooLarge", err) 115 } 116} 117 118// TestDimensionBombIsRejected. DecodeConfig reads only the header, so a small file can declare enormous 119// dimensions. Without the bound a downstream resize would try to allocate that much memory. 120func TestDimensionBombIsRejected(t *testing.T) { 121 over := pngOf(t, MaxLogoDimension+1, 4) 122 if err := validate(over); err != ErrLogoTooBig { 123 t.Errorf("oversized dimension error = %v, want ErrLogoTooBig", err) 124 } 125 edge := pngOf(t, MaxLogoDimension, 4) 126 if err := validate(edge); err != nil { 127 t.Errorf("a logo exactly at the dimension bound was rejected: %v", err) 128 } 129} 130 131// TestFormatAllowlistIsTheAuthority pins that adding a format is a deliberate edit to the map, not a side 132// effect of which decoders happen to be linked into the binary. 133func TestFormatAllowlistIsTheAuthority(t *testing.T) { 134 if len(formatMIME) != 2 { 135 t.Fatalf("format allowlist has %d entries, want exactly png and jpeg", len(formatMIME)) 136 } 137 for _, want := range []string{"png", "jpeg"} { 138 if _, ok := formatMIME[want]; !ok { 139 t.Errorf("format %q missing from the allowlist", want) 140 } 141 } 142 for _, forbidden := range []string{"gif", "svg", "webp", "bmp", "tiff"} { 143 if _, ok := formatMIME[forbidden]; ok { 144 t.Errorf("format %q is in the allowlist and must not be", forbidden) 145 } 146 } 147} 148 149// TestETagIsContentAddressed. Deriving the validator from the bytes means a rollback to a previous logo 150// still busts the cache, which a timestamp based validator would not. 151func TestETagIsContentAddressed(t *testing.T) { 152 a, b := pngOf(t, 8, 8), pngOf(t, 9, 9) 153 if etagFor(a) == etagFor(b) { 154 t.Error("different images produced the same etag") 155 } 156 if etagFor(a) != etagFor(a) { 157 t.Error("the same image produced different etags") 158 } 159 if !strings.HasPrefix(etagFor(a), `"`) || !strings.HasSuffix(etagFor(a), `"`) { 160 t.Errorf("etag %s is not a quoted string as HTTP requires", etagFor(a)) 161 } 162} 163 164// TestMaxLogoBytesMatchesTheMigration guards the two limits drifting apart. The database CHECK in 165// migration 0046 is the last line of defense and must agree with the application. 166func TestMaxLogoBytesMatchesTheMigration(t *testing.T) { 167 if MaxLogoBytes != 524288 { 168 t.Errorf("MaxLogoBytes = %d but migration 0046 checks octet_length <= 524288", MaxLogoBytes) 169 } 170 if MaxDisplayName != 120 { 171 t.Errorf("MaxDisplayName = %d but migration 0046 checks length between 1 and 120", MaxDisplayName) 172 } 173} 174 175func mustDecodeB64(t *testing.T, s string) []byte { 176 t.Helper() 177 b, err := base64.StdEncoding.DecodeString(s) 178 if err != nil { 179 t.Fatalf("decode fixture: %v", err) 180 } 181 return b 182} 183