Build ErsatzTV Image / Docs update reminder (pull_request) Successful in 5s
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 8m33s
Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 10m40s
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped
S4 stored-XSS + S9 upload-size DoS from the #197 cold API review. The artwork path trusted client-supplied content types at both ends: upload validated only the declared multipart Content-Type (never decoded the bytes), and serving reflected a client `?contentType=` straight into the response Content-Type on unauthenticated GET sinks (/iptv/logos, /artwork/watermarks). Chain: upload <script> bytes as image/png -> GET ...?contentType=text/html serves them as HTML in-origin. nosniff (#279) does not help because the server explicitly declares text/html. - Upload: derive the content type from the bytes via SkiaSharp SKCodec (header-only, no decode -> no decompression-bomb path); reject non-images 422. New ErsatzTV.Core/Images/ImageContentTypes as the single allow-list source. Dropped the untrusted declared Content-Type from the UploadArtwork command. - Serve: removed the ?contentType= reflection structurally -- dropped ContentType from GetCachedImagePath and the [FromQuery] binding on GetImage/GetWatermark; the handler always sniffs the file, defaulting application/octet-stream. ArtworkContentTypeModel.UrlWithContentType is now the bare path; SPA previews no longer append the query. - Defense-in-depth: channel-logo / watermark {path, contentType} DTOs run through ArtworkContentTypeModel.Sanitized(), blanking non-allow-listed types on write. - S9: Kestrel MaxRequestBodySize from ETV_MAXIMUM_UPLOAD_MB rejects oversized bodies during read (controller file.Length check kept as friendly-error backstop). Both serve sinks are IgnoreApi, so no OpenAPI change. Tests: byte-sniff accept/ reject, Sanitized() allow-list, Location no longer carries ?contentType=. Docs: api-conventions §4a + decisions.md 2026-07-12. Refs #283 #197 #66 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
166 lines
6.6 KiB
C#
166 lines
6.6 KiB
C#
using System.Reflection;
|
|
using ErsatzTV.Application.Artworks;
|
|
using ErsatzTV.Controllers.Api;
|
|
using ErsatzTV.Core;
|
|
using ErsatzTV.Core.Api.Artwork;
|
|
using ErsatzTV.Core.Domain;
|
|
using MediatR;
|
|
using Microsoft.AspNetCore.Http;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using Microsoft.AspNetCore.Mvc.Routing;
|
|
using NSubstitute;
|
|
using NUnit.Framework;
|
|
using Shouldly;
|
|
using static LanguageExt.Prelude;
|
|
|
|
namespace ErsatzTV.Tests.Controllers;
|
|
|
|
[TestFixture]
|
|
public class ArtworkUploadControllerTests
|
|
{
|
|
private ArtworkUploadController _controller = null!;
|
|
private IMediator _mediator = null!;
|
|
|
|
[SetUp]
|
|
public void SetUp()
|
|
{
|
|
_mediator = Substitute.For<IMediator>();
|
|
_controller = new ArtworkUploadController(_mediator);
|
|
}
|
|
|
|
[Test]
|
|
public void Controller_Should_Expose_Idiomatic_Rest_Route()
|
|
{
|
|
MethodInfo action = typeof(ArtworkUploadController).GetMethod(nameof(ArtworkUploadController.Upload))
|
|
?? throw new AssertionException("Missing action Upload");
|
|
|
|
HttpMethodAttribute attribute = action.GetCustomAttributes<HttpMethodAttribute>(inherit: true).Single();
|
|
attribute.HttpMethods.ShouldContain("POST");
|
|
attribute.Template.ShouldBe("/api/artwork/uploads");
|
|
attribute.Name.ShouldBe("UploadArtwork");
|
|
}
|
|
|
|
[Test]
|
|
public void Action_Should_Consume_Multipart_Form_Data()
|
|
{
|
|
MethodInfo action = typeof(ArtworkUploadController).GetMethod(nameof(ArtworkUploadController.Upload))
|
|
?? throw new AssertionException("Missing action Upload");
|
|
|
|
var consumes = action.GetCustomAttribute<ConsumesAttribute>();
|
|
consumes.ShouldNotBeNull();
|
|
consumes.ContentTypes.ShouldContain("multipart/form-data");
|
|
}
|
|
|
|
[Test]
|
|
public async Task Upload_Should_Return_422_When_File_Missing()
|
|
{
|
|
IActionResult result = await _controller.Upload(null!, "logo", CancellationToken.None);
|
|
|
|
var unprocessable = result.ShouldBeOfType<UnprocessableEntityObjectResult>();
|
|
var problem = unprocessable.Value.ShouldBeOfType<ProblemDetails>();
|
|
problem.Status.ShouldBe(422);
|
|
problem.Title.ShouldBe("Validation failed");
|
|
await _mediator.DidNotReceive().Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Test]
|
|
public async Task Upload_Should_Return_422_When_File_Empty()
|
|
{
|
|
IFormFile emptyFile = MakeFormFile([], "image/png");
|
|
|
|
IActionResult result = await _controller.Upload(emptyFile, "logo", CancellationToken.None);
|
|
|
|
result.ShouldBeOfType<UnprocessableEntityObjectResult>();
|
|
await _mediator.DidNotReceive().Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Test]
|
|
public async Task Upload_Should_Return_422_When_File_Exceeds_Maximum_Size()
|
|
{
|
|
var oversizeBytes = new byte[(SystemEnvironment.MaximumUploadMb * 1024 * 1024) + 1];
|
|
IFormFile oversizeFile = MakeFormFile(oversizeBytes, "image/png");
|
|
|
|
IActionResult result = await _controller.Upload(oversizeFile, "logo", CancellationToken.None);
|
|
|
|
var unprocessable = result.ShouldBeOfType<UnprocessableEntityObjectResult>();
|
|
var problem = unprocessable.Value.ShouldBeOfType<ProblemDetails>();
|
|
problem.Detail.ShouldContain("maximum allowed size");
|
|
await _mediator.DidNotReceive().Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Test]
|
|
public async Task Upload_Should_Return_422_For_Unknown_Target()
|
|
{
|
|
IFormFile file = MakeFormFile([1, 2, 3], "image/png");
|
|
|
|
IActionResult result = await _controller.Upload(file, "poster", CancellationToken.None);
|
|
|
|
var unprocessable = result.ShouldBeOfType<UnprocessableEntityObjectResult>();
|
|
var problem = unprocessable.Value.ShouldBeOfType<ProblemDetails>();
|
|
problem.Detail.ShouldContain("Unknown upload target");
|
|
await _mediator.DidNotReceive().Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Test]
|
|
public async Task Upload_Should_Send_UploadArtwork_With_Logo_Kind_And_Return_201()
|
|
{
|
|
IFormFile file = MakeFormFile([1, 2, 3], "image/png");
|
|
_mediator.Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>())
|
|
.Returns(Right<BaseError, ArtworkUploadResponseModel>(
|
|
new ArtworkUploadResponseModel("iptv/logos/abc.png", "image/png")));
|
|
|
|
IActionResult result = await _controller.Upload(file, "logo", CancellationToken.None);
|
|
|
|
var created = result.ShouldBeOfType<CreatedResult>();
|
|
created.StatusCode.ShouldBe(201);
|
|
// No ?contentType= — the serve route sniffs the stored file (issue #283).
|
|
created.Location.ShouldBe("/iptv/logos/abc.png");
|
|
created.Value.ShouldBeOfType<ArtworkUploadResponseModel>()
|
|
.Path.ShouldBe("iptv/logos/abc.png");
|
|
|
|
await _mediator.Received(1).Send(
|
|
Arg.Is<UploadArtwork>(c => c.ArtworkKind == ArtworkKind.Logo),
|
|
Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Test]
|
|
public async Task Upload_Should_Send_UploadArtwork_With_Watermark_Kind_And_Return_201()
|
|
{
|
|
IFormFile file = MakeFormFile([1, 2, 3], "image/webp");
|
|
_mediator.Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>())
|
|
.Returns(Right<BaseError, ArtworkUploadResponseModel>(
|
|
new ArtworkUploadResponseModel("def.webp", "image/webp")));
|
|
|
|
IActionResult result = await _controller.Upload(file, "watermark", CancellationToken.None);
|
|
|
|
var created = result.ShouldBeOfType<CreatedResult>();
|
|
created.Location.ShouldBe("/artwork/watermarks/def.webp");
|
|
|
|
await _mediator.Received(1).Send(
|
|
Arg.Is<UploadArtwork>(c => c.ArtworkKind == ArtworkKind.Watermark),
|
|
Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Test]
|
|
public async Task Upload_Should_Return_422_On_Handler_Validation_Error()
|
|
{
|
|
IFormFile file = MakeFormFile([1, 2, 3], "image/bmp");
|
|
_mediator.Send(Arg.Any<UploadArtwork>(), Arg.Any<CancellationToken>())
|
|
.Returns(Left<BaseError, ArtworkUploadResponseModel>(BaseError.New("unsupported content type")));
|
|
|
|
IActionResult result = await _controller.Upload(file, "logo", CancellationToken.None);
|
|
|
|
var unprocessable = result.ShouldBeOfType<UnprocessableEntityObjectResult>();
|
|
var problem = unprocessable.Value.ShouldBeOfType<ProblemDetails>();
|
|
problem.Status.ShouldBe(422);
|
|
problem.Title.ShouldBe("Validation failed");
|
|
}
|
|
|
|
private static IFormFile MakeFormFile(byte[] bytes, string contentType) =>
|
|
new FormFile(new MemoryStream(bytes), 0, bytes.Length, "file", "upload.bin")
|
|
{
|
|
Headers = new HeaderDictionary(),
|
|
ContentType = contentType
|
|
};
|
|
}
|