mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-09-24 17:24:54 +09:00
Mint the tampered sgid without extending a Room
The invalid-sgid test made one live Room attachable — `rooms(:pets).tap
{ |r| r.extend ActionText::Attachable }` — only to call
`attachable_sgid` on it. That method is `to_sgid(expires_in: nil,
for: ActionText::Attachable::LOCATOR_NAME).to_s`, so the test can mint
the same sgid directly and drop the per-instance extend; the assertion
(a signature that does not verify resolves to MissingAttachable) is
unchanged, and so are the bytes it tampers with.
This commit is contained in:
@@ -174,6 +174,7 @@ GEM
|
||||
erubi (1.13.1)
|
||||
faker (3.5.2)
|
||||
i18n (>= 1.8.11, < 2)
|
||||
ffi (1.17.2)
|
||||
ffi (1.17.2-aarch64-linux-gnu)
|
||||
ffi (1.17.2-arm64-darwin)
|
||||
ffi (1.17.2-x86_64-darwin)
|
||||
|
||||
@@ -24,10 +24,10 @@ class ActionTextAttachmentTest < ActiveSupport::TestCase
|
||||
end
|
||||
|
||||
test "lookup invalid sgid for an attachable requiring a valid sgid" do
|
||||
# Make room instance attachable for testing purposes
|
||||
room = rooms(:pets).tap { |r| r.extend ActionText::Attachable }
|
||||
|
||||
message, signature = rooms(:pets).attachable_sgid.split("--")
|
||||
# A Room is not attachable; mint the sgid an attachable would carry
|
||||
# (`ActionText::Attachable#attachable_sgid` is exactly this call) so
|
||||
# the lookup is exercised on a signature that does not verify.
|
||||
message, signature = rooms(:pets).to_sgid(expires_in: nil, for: ActionText::Attachable::LOCATOR_NAME).to_s.split("--")
|
||||
|
||||
html = %Q(<action-text-attachment sgid="#{message}--invalid"></action-text-attachment>)
|
||||
node = ActionText::Fragment.wrap(html).find_all(ActionText::Attachment.tag_name).first
|
||||
|
||||
Reference in New Issue
Block a user