mirror of
https://github.com/Matysh/houseplan-card
synced 2026-07-31 08:28:31 +00:00
Matysh
c1e3cdb768
- upload/plan_set tests asserted the old public /houseplan_files/... paths and only run in CI, so the B1 change surfaced there - +test for the fail-closed admin check (audit B2/T4: the authorization boundary had zero coverage)
62 lines
2.4 KiB
Python
62 lines
2.4 KiB
Python
"""HTTP upload endpoint tests (CI)."""
|
|
import pytest
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _enable_custom_integrations(enable_custom_integrations):
|
|
"""Allow loading custom_components in the test hass."""
|
|
yield
|
|
|
|
from aiohttp import FormData
|
|
from homeassistant.core import HomeAssistant
|
|
from pytest_homeassistant_custom_component.common import MockConfigEntry
|
|
from pytest_homeassistant_custom_component.typing import ClientSessionGenerator
|
|
|
|
from custom_components.houseplan.const import DOMAIN
|
|
|
|
|
|
async def _setup(hass: HomeAssistant) -> None:
|
|
entry = MockConfigEntry(domain=DOMAIN, title="House Plan", data={}, options={})
|
|
entry.add_to_hass(hass)
|
|
assert await hass.config_entries.async_setup(entry.entry_id)
|
|
await hass.async_block_till_done()
|
|
|
|
|
|
async def test_upload_ok(hass: HomeAssistant, hass_client: ClientSessionGenerator) -> None:
|
|
await _setup(hass)
|
|
client = await hass_client()
|
|
fd = FormData()
|
|
fd.add_field("marker_id", "m1")
|
|
fd.add_field("file", b"%PDF-1.4 test", filename="manual.pdf", content_type="application/pdf")
|
|
resp = await client.post("/api/houseplan/upload", data=fd)
|
|
assert resp.status == 200
|
|
body = await resp.json()
|
|
# audit B1: uploads now return the AUTHENTICATED content URL
|
|
assert body["ok"] and body["url"].startswith("/api/houseplan/content/files/m1/manual.pdf?v=")
|
|
|
|
|
|
async def test_upload_bad_ext(hass: HomeAssistant, hass_client: ClientSessionGenerator) -> None:
|
|
await _setup(hass)
|
|
client = await hass_client()
|
|
fd = FormData()
|
|
fd.add_field("file", b"MZ", filename="evil.exe")
|
|
resp = await client.post("/api/houseplan/upload", data=fd)
|
|
assert resp.status == 400
|
|
assert (await resp.json())["error"] == "bad_ext"
|
|
|
|
|
|
async def test_upload_traversal_sanitized(hass: HomeAssistant, hass_client: ClientSessionGenerator) -> None:
|
|
await _setup(hass)
|
|
client = await hass_client()
|
|
fd = FormData()
|
|
fd.add_field("marker_id", "../../etc")
|
|
fd.add_field("file", b"x", filename="../..//passwd.txt")
|
|
resp = await client.post("/api/houseplan/upload", data=fd)
|
|
assert resp.status == 200
|
|
body = await resp.json()
|
|
# both the marker dir and the filename must be flattened to safe names:
|
|
# no path segment may be exactly ".." (dots inside a name are harmless)
|
|
path = body["url"].split("?", 1)[0]
|
|
assert all(seg != ".." for seg in path.split("/"))
|
|
assert path.startswith("/api/houseplan/content/files/")
|