18 lines
3.8 KiB
TypeScript
18 lines
3.8 KiB
TypeScript
import { mkdtemp } from "node:fs/promises";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import sharp from "sharp";
|
|
import { describe, expect, it } from "vitest";
|
|
import { MemoryAttachmentStore } from "../src/attachments.js";
|
|
import { SafeWorkspace } from "../src/safe-workspace.js";
|
|
async function stream(buffer: Buffer) { return { async *[Symbol.asyncIterator]() { yield buffer; } }; }
|
|
describe("attachments", () => {
|
|
async function setup(max=1024*1024) { const root=await mkdtemp(path.join(os.tmpdir(),"asm-att-")); const ws=new SafeWorkspace(root); await ws.init(); return { ws, store:new MemoryAttachmentStore(()=>ws,max) }; }
|
|
for (const [format,mime,ext] of [["jpeg","image/jpeg","jpg"],["png","image/png","png"],["webp","image/webp","webp"]] as const) it(`accepts ${format}`, async () => { const {ws,store}=await setup(); const buffer=await sharp({create:{width:8,height:6,channels:3,background:"red"}})[format]().toBuffer(); const item=await store.add("s",{filename:`a.${ext}`,mimetype:mime,stream:await stream(buffer)}); expect([item.width,item.height,item.mediaType]).toEqual([8,6,mime]); await ws.remove(); });
|
|
it("rejects spoofed MIME, SVG and oversized input", async () => { const {ws,store}=await setup(); const png=await sharp({create:{width:2,height:2,channels:3,background:"red"}}).png().toBuffer(); await expect(store.add("s",{filename:"a.jpg",mimetype:"image/jpeg",stream:await stream(png)})).rejects.toThrow(/内容/); await expect(store.add("s",{filename:"x.svg",mimetype:"image/svg+xml",stream:await stream(Buffer.from("<svg/>"))})).rejects.toThrow(/仅支持/); const tiny=new MemoryAttachmentStore(()=>ws,10); await expect(tiny.add("s",{filename:"a.png",mimetype:"image/png",stream:await stream(png)})).rejects.toThrow(/大小/); await ws.remove(); });
|
|
it("isolates session lookup and removes files", async () => { const {ws,store}=await setup(); const png=await sharp({create:{width:2,height:2,channels:3,background:"red"}}).png().toBuffer(); const item=await store.add("one",{filename:"a.png",mimetype:"image/png",stream:await stream(png)}); expect(store.get("two",item.attachmentId)).toBeUndefined(); await store.removeAll("one"); expect(store.get("one",item.attachmentId)).toBeUndefined(); await ws.remove(); });
|
|
it("accepts UTF-8 CSV and TSV as spreadsheet attachments", async () => { const {ws,store}=await setup(); const csv=await store.add("s",{filename:"日报.csv",mimetype:"text/csv",stream:await stream(Buffer.from("日期,Ad,消耗\n2026-09-15,A,12\n"))}); const tsv=await store.add("s",{filename:"report.tsv",mimetype:"text/plain",stream:await stream(Buffer.from("date\tad\tspend\n2026-09-15\tA\t12\n"))}); expect(csv).toMatchObject({kind:"spreadsheet",mediaType:"text/csv",name:"日报.csv"}); expect(tsv).toMatchObject({kind:"spreadsheet",mediaType:"text/tab-separated-values"}); await ws.remove(); });
|
|
it("accepts non-standard spreadsheet MIME after content validation", async () => { const {ws,store}=await setup(); const csv=await store.add("s",{filename:"wps-export.csv",mimetype:"application/x-wps-office.csv",stream:await stream(Buffer.from("date,ad,spend\n2026-09-15,A,12\n"))}); expect(csv).toMatchObject({kind:"spreadsheet",mediaType:"text/csv"}); await ws.remove(); });
|
|
it("rejects legacy XLS, invalid UTF-8 and spoofed XLSX", async () => { const {ws,store}=await setup(); await expect(store.add("s",{filename:"old.xls",mimetype:"application/vnd.ms-excel",stream:await stream(Buffer.from("x"))})).rejects.toThrow(/另存为 .xlsx/); await expect(store.add("s",{filename:"bad.csv",mimetype:"text/csv",stream:await stream(Buffer.from([0xff,0xfe]))})).rejects.toThrow(/UTF-8/); await expect(store.add("s",{filename:"fake.xlsx",mimetype:"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",stream:await stream(Buffer.from("not a zip"))})).rejects.toThrow(/有效的 XLSX/); await ws.remove(); });
|
|
});
|