Files
ersatztv/ErsatzTV.Tests/Controllers/ArtworkUploadControllerTests.cs
T
timothyandClaude Opus 4.8 cf834d8b60
Build ErsatzTV Image / Docs update reminder (pull_request) Successful in 5s
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 8m33s
Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 10m40s
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped
security(#283): sniff artwork content type from bytes, remove serve-side ?contentType= reflection
S4 stored-XSS + S9 upload-size DoS from the #197 cold API review.

The artwork path trusted client-supplied content types at both ends: upload
validated only the declared multipart Content-Type (never decoded the bytes),
and serving reflected a client `?contentType=` straight into the response
Content-Type on unauthenticated GET sinks (/iptv/logos, /artwork/watermarks).
Chain: upload <script> bytes as image/png -> GET ...?contentType=text/html
serves them as HTML in-origin. nosniff (#279) does not help because the server
explicitly declares text/html.

- Upload: derive the content type from the bytes via SkiaSharp SKCodec
  (header-only, no decode -> no decompression-bomb path); reject non-images 422.
  New ErsatzTV.Core/Images/ImageContentTypes as the single allow-list source.
  Dropped the untrusted declared Content-Type from the UploadArtwork command.
- Serve: removed the ?contentType= reflection structurally -- dropped ContentType
  from GetCachedImagePath and the [FromQuery] binding on GetImage/GetWatermark;
  the handler always sniffs the file, defaulting application/octet-stream.
  ArtworkContentTypeModel.UrlWithContentType is now the bare path; SPA previews
  no longer append the query.
- Defense-in-depth: channel-logo / watermark {path, contentType} DTOs run through
  ArtworkContentTypeModel.Sanitized(), blanking non-allow-listed types on write.
- S9: Kestrel MaxRequestBodySize from ETV_MAXIMUM_UPLOAD_MB rejects oversized
  bodies during read (controller file.Length check kept as friendly-error backstop).

Both serve sinks are IgnoreApi, so no OpenAPI change. Tests: byte-sniff accept/
reject, Sanitized() allow-list, Location no longer carries ?contentType=.
Docs: api-conventions §4a + decisions.md 2026-07-12.

Refs #283 #197 #66

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 00:07:55 +02:00

166 lines
6.6 KiB
C#

using System.Reflection;
using ErsatzTV.Application.Artworks;
using ErsatzTV.Controllers.Api;
using ErsatzTV.Core;
using ErsatzTV.Core.Api.Artwork;
using ErsatzTV.Core.Domain;
using MediatR;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Routing;
using NSubstitute;
using NUnit.Framework;
using Shouldly;
using static LanguageExt.Prelude;
namespace ErsatzTV.Tests.Controllers;
[TestFixture]
public class ArtworkUploadControllerTests
{
private ArtworkUploadController _controller = null!;
private IMediator _mediator = null!;
[SetUp]
public void SetUp()
{
_mediator = Substitute.For<IMediator>();
_controller = new ArtworkUploadController(_mediator);
}
[Test]
public void Controller_Should_Expose_Idiomatic_Rest_Route()
{
MethodInfo action = typeof(ArtworkUploadController).GetMethod(nameof(ArtworkUploadController.Upload))
?? throw new AssertionException("Missing action Upload");
HttpMethodAttribute attribute = action.GetCustomAttributes<HttpMethodAttribute>(inherit: true).Single();
attribute.HttpMethods.ShouldContain("POST");
attribute.Template.ShouldBe("/api/artwork/uploads");
attribute.Name.ShouldBe("UploadArtwork");
}
[Test]
public void Action_Should_Consume_Multipart_Form_Data()
{
MethodInfo action = typeof(ArtworkUploadController).GetMethod(nameof(ArtworkUploadController.Upload))
?? throw new AssertionException("Missing action Upload");
var consumes = action.GetCustomAttribute<ConsumesAttribute>();
consumes.ShouldNotBeNull();
consumes.ContentTypes.ShouldContain("multipart/form-data");
}
[Test]
public async Task Upload_Should_Return_422_When_File_Missing()
{
IActionResult result = await _controller.Upload(null!, "logo", CancellationToken.None);
var unprocessable = result.ShouldBeOfType<UnprocessableEntityObjectResult>();
var problem = unprocessable.Value.ShouldBeOfType<ProblemDetails>();
problem.Status.ShouldBe(422);
problem.Title.ShouldBe("Validation failed");
await _mediator.DidNotReceive().Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>());
}
[Test]
public async Task Upload_Should_Return_422_When_File_Empty()
{
IFormFile emptyFile = MakeFormFile([], "image/png");
IActionResult result = await _controller.Upload(emptyFile, "logo", CancellationToken.None);
result.ShouldBeOfType<UnprocessableEntityObjectResult>();
await _mediator.DidNotReceive().Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>());
}
[Test]
public async Task Upload_Should_Return_422_When_File_Exceeds_Maximum_Size()
{
var oversizeBytes = new byte[(SystemEnvironment.MaximumUploadMb * 1024 * 1024) + 1];
IFormFile oversizeFile = MakeFormFile(oversizeBytes, "image/png");
IActionResult result = await _controller.Upload(oversizeFile, "logo", CancellationToken.None);
var unprocessable = result.ShouldBeOfType<UnprocessableEntityObjectResult>();
var problem = unprocessable.Value.ShouldBeOfType<ProblemDetails>();
problem.Detail.ShouldContain("maximum allowed size");
await _mediator.DidNotReceive().Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>());
}
[Test]
public async Task Upload_Should_Return_422_For_Unknown_Target()
{
IFormFile file = MakeFormFile([1, 2, 3], "image/png");
IActionResult result = await _controller.Upload(file, "poster", CancellationToken.None);
var unprocessable = result.ShouldBeOfType<UnprocessableEntityObjectResult>();
var problem = unprocessable.Value.ShouldBeOfType<ProblemDetails>();
problem.Detail.ShouldContain("Unknown upload target");
await _mediator.DidNotReceive().Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>());
}
[Test]
public async Task Upload_Should_Send_UploadArtwork_With_Logo_Kind_And_Return_201()
{
IFormFile file = MakeFormFile([1, 2, 3], "image/png");
_mediator.Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>())
.Returns(Right<BaseError, ArtworkUploadResponseModel>(
new ArtworkUploadResponseModel("iptv/logos/abc.png", "image/png")));
IActionResult result = await _controller.Upload(file, "logo", CancellationToken.None);
var created = result.ShouldBeOfType<CreatedResult>();
created.StatusCode.ShouldBe(201);
// No ?contentType= — the serve route sniffs the stored file (issue #283).
created.Location.ShouldBe("/iptv/logos/abc.png");
created.Value.ShouldBeOfType<ArtworkUploadResponseModel>()
.Path.ShouldBe("iptv/logos/abc.png");
await _mediator.Received(1).Send(
Arg.Is<UploadArtwork>(c => c.ArtworkKind == ArtworkKind.Logo),
Arg.Any<CancellationToken>());
}
[Test]
public async Task Upload_Should_Send_UploadArtwork_With_Watermark_Kind_And_Return_201()
{
IFormFile file = MakeFormFile([1, 2, 3], "image/webp");
_mediator.Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>())
.Returns(Right<BaseError, ArtworkUploadResponseModel>(
new ArtworkUploadResponseModel("def.webp", "image/webp")));
IActionResult result = await _controller.Upload(file, "watermark", CancellationToken.None);
var created = result.ShouldBeOfType<CreatedResult>();
created.Location.ShouldBe("/artwork/watermarks/def.webp");
await _mediator.Received(1).Send(
Arg.Is<UploadArtwork>(c => c.ArtworkKind == ArtworkKind.Watermark),
Arg.Any<CancellationToken>());
}
[Test]
public async Task Upload_Should_Return_422_On_Handler_Validation_Error()
{
IFormFile file = MakeFormFile([1, 2, 3], "image/bmp");
_mediator.Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>())
.Returns(Left<BaseError, ArtworkUploadResponseModel>(BaseError.New("unsupported content type")));
IActionResult result = await _controller.Upload(file, "logo", CancellationToken.None);
var unprocessable = result.ShouldBeOfType<UnprocessableEntityObjectResult>();
var problem = unprocessable.Value.ShouldBeOfType<ProblemDetails>();
problem.Status.ShouldBe(422);
problem.Title.ShouldBe("Validation failed");
}
private static IFormFile MakeFormFile(byte[] bytes, string contentType) =>
new FormFile(new MemoryStream(bytes), 0, bytes.Length, "file", "upload.bin")
{
Headers = new HeaderDictionary(),
ContentType = contentType
};
}