mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-10-28 00:16:48 +09:00
Jeremy Daer
9c37f41ff6
A request for several byte ranges gets a 206 multipart/byteranges whose boundary the client needs to split the body. Rewriting it to octet-stream lost the boundary. No browser runs that type as a script, so it passes through.
43 lines
1.9 KiB
Ruby
43 lines
1.9 KiB
Ruby
require "test_helper"
|
|
|
|
class UploadedScriptGuardTest < ActiveSupport::TestCase
|
|
# Every JavaScript MIME type essence in the MIME Sniffing Standard, plus
|
|
# parameters and casing a signed Disk URL might carry.
|
|
SCRIPT_TYPES = %w[
|
|
application/ecmascript application/javascript application/x-ecmascript application/x-javascript
|
|
text/ecmascript text/javascript text/javascript1.0 text/javascript1.1 text/javascript1.2 text/javascript1.3
|
|
text/javascript1.4 text/javascript1.5 text/jscript text/livescript text/x-ecmascript text/x-javascript
|
|
] + [ "Text/JavaScript; charset=utf-8" ]
|
|
|
|
test "uploads never leave with a script type, whatever the URL says" do
|
|
SCRIPT_TYPES.each do |type|
|
|
assert_equal ActiveStorage.binary_content_type, served_type(type, "#{ActiveStorage.routes_prefix}/disk/key/probe.js"), type
|
|
end
|
|
end
|
|
|
|
test "media and downloads keep their type" do
|
|
%w[ image/png video/mp4 audio/mpeg application/pdf text/plain ].each do |type|
|
|
assert_equal type, served_type(type, "#{ActiveStorage.routes_prefix}/disk/key/file"), type
|
|
end
|
|
end
|
|
|
|
test "multi-range responses keep their boundary" do
|
|
type = "multipart/byteranges; boundary=AaB03x"
|
|
assert_equal type, served_type(type, "#{ActiveStorage.routes_prefix}/blobs/proxy/key/movie.mp4")
|
|
end
|
|
|
|
test "direct upload responses keep their JSON type" do
|
|
assert_equal "application/json", served_type("application/json", "#{ActiveStorage.routes_prefix}/direct_uploads", method: "POST")
|
|
end
|
|
|
|
test "application responses outside uploads are untouched" do
|
|
assert_equal "text/javascript", served_type("text/javascript", "/assets/application-abc123.js")
|
|
end
|
|
|
|
private
|
|
def served_type(type, path, method: "GET")
|
|
app = ->(env) { [ 200, { "content-type" => type }, [ "" ] ] }
|
|
UploadedScriptGuard.new(app).call(Rack::MockRequest.env_for(path, method: method))[1]["content-type"]
|
|
end
|
|
end
|