scheme_handler_systemviews_test.go RawHistoryFolder

1package cef
2
3import (
4	"bytes"
5	"net/url"
6	"testing"
7	"testing/fstest"
8
9	"github.com/andybalholm/brotli"
10)
11
12func TestResolveAssetPath_SystemviewsRootsUseSystemviewsShell(t *testing.T) {
13	t.Parallel()
14
15	tests := []struct {
16		name    string
17		raw     string
18		wantDir string
19		wantRel string
20	}{
21		{name: "history host", raw: "https://dumber.invalid/history", wantDir: "systemviews", wantRel: indexHTML},
22		{name: "favorites host", raw: "https://dumber.invalid/favorites", wantDir: "systemviews", wantRel: indexHTML},
23		{name: "config host", raw: "https://dumber.invalid/config", wantDir: "systemviews", wantRel: indexHTML},
24		{name: "root wasm exec", raw: "https://dumber.invalid/wasm_exec.js", wantDir: "systemviews", wantRel: "wasm_exec.js"},
25		{name: "root wasm asset", raw: "https://dumber.invalid/systemviews.wasm", wantDir: "systemviews", wantRel: "systemviews.wasm"},
26		{name: "root css asset", raw: "https://dumber.invalid/systemviews.css", wantDir: "systemviews", wantRel: "systemviews.css"},
27		{name: "history opaque", raw: "dumb:history", wantDir: "systemviews", wantRel: indexHTML},
28		{name: "history sub-asset", raw: "https://dumber.invalid/history/wasm_exec.js", wantDir: "systemviews", wantRel: "wasm_exec.js"},
29		{name: "history css asset", raw: "https://dumber.invalid/history/systemviews.css", wantDir: "systemviews", wantRel: "systemviews.css"},
30	}
31
32	for _, tt := range tests {
33		t.Run(tt.name, func(t *testing.T) {
34			t.Parallel()
35			u := mustParseURL(t, tt.raw)
36			gotDir, gotRel, ok := resolveAssetPath(u)
37			if !ok {
38				t.Fatalf("resolveAssetPath(%q) = not ok", tt.raw)
39			}
40			if gotDir != tt.wantDir || gotRel != tt.wantRel {
41				t.Fatalf("resolveAssetPath(%q) = (%q, %q), want (%q, %q)", tt.raw, gotDir, gotRel, tt.wantDir, tt.wantRel)
42			}
43		})
44	}
45}
46
47func TestReadAssetWithEncoding_DecompressesBrotliWASM(t *testing.T) {
48	t.Parallel()
49
50	wasm := []byte("\x00asmfixture")
51	fsys := fstest.MapFS{
52		"systemviews/systemviews.wasm.br": {Data: brotliCompressForTest(t, wasm)},
53	}
54
55	data, err := readAssetWithEncoding(fsys, "systemviews/systemviews.wasm", "systemviews.wasm")
56	if err != nil {
57		t.Fatalf("readAssetWithEncoding() error = %v", err)
58	}
59	if !bytes.Equal(data, wasm) {
60		t.Fatalf("decompressed wasm = %q, want %q", data, wasm)
61	}
62}
63
64func brotliCompressForTest(t *testing.T, data []byte) []byte {
65	t.Helper()
66	var buf bytes.Buffer
67	w := brotli.NewWriter(&buf)
68	if _, err := w.Write(data); err != nil {
69		t.Fatalf("brotli write: %v", err)
70	}
71	if err := w.Close(); err != nil {
72		t.Fatalf("brotli close: %v", err)
73	}
74	return buf.Bytes()
75}
76
77func mustParseURL(t *testing.T, raw string) *url.URL {
78	t.Helper()
79	u, err := url.Parse(raw)
80	if err != nil {
81		t.Fatalf("url.Parse(%q) error = %v", raw, err)
82	}
83	return u
84}
85
86func TestSafeSystemviewsAssetPathRejectsTraversal(t *testing.T) {
87	t.Parallel()
88
89	fullPath, relPath, ok := safeSystemviewsAssetPath(systemviewsAssetDir, "nested/../systemviews.css")
90	if !ok {
91		t.Fatal("safeSystemviewsAssetPath() rejected safe cleaned path")
92	}
93	if fullPath != "systemviews/systemviews.css" || relPath != "systemviews.css" {
94		t.Fatalf("safeSystemviewsAssetPath() = (%q, %q), want (systemviews/systemviews.css, systemviews.css)", fullPath, relPath)
95	}
96
97	invalid := []struct {
98		name     string
99		assetDir string
100		relPath  string
101	}{
102		{name: "parent escape", assetDir: systemviewsAssetDir, relPath: "../logo.svg"},
103		{name: "nested parent escape", assetDir: systemviewsAssetDir, relPath: "nested/../../logo.svg"},
104		{name: "absolute parent escape", assetDir: systemviewsAssetDir, relPath: "/../logo.svg"},
105		{name: "null byte", assetDir: systemviewsAssetDir, relPath: "systemviews.css\x00"},
106		{name: "wrong asset dir", assetDir: "logos", relPath: "logo.svg"},
107	}
108	for _, tt := range invalid {
109		t.Run(tt.name, func(t *testing.T) {
110			t.Parallel()
111			if fullPath, relPath, ok := safeSystemviewsAssetPath(tt.assetDir, tt.relPath); ok {
112				t.Fatalf("safeSystemviewsAssetPath(%q, %q) = (%q, %q, true), want rejected", tt.assetDir, tt.relPath, fullPath, relPath)
113			}
114		})
115	}
116}