a36a4cac6b
Validation: the dump validators refuse the nulls their shared types don't allow (a null title or note on creation, a null URL on edit); a playlist title of spaces is refused and titles are stored trimmed; usernames and emails are checked by the same USERNAME_RE and EMAIL_RE in shared/validation.ts on sign-up, on PATCH /api/users/me (which checked other limits) and in the sign-up form. Mentions are read by shared/mention.ts's mentionedUsernames, which skips code and URLs as Markdown shows them: https://mastodon.social/@bob or a `@bob` in code notified bob; the editor's suggestions derive their trigger from the same pattern instead of a copy. Following an unknown user is a 404 rather than a foreign-key 500, and following a private playlist a 404 rather than a 403 that confirmed it exists. `ws` and `emojibase` are reserved category slugs, since the server answers them before the app. GET /api/users/me no longer turns every error into a 500. Dead code goes: adminOnlyMiddleware, verifyEmailTransport, listUsers, deleteUser with disconnectUser and the force_logout message only it sent, PATCH /api/notifications/:id/read (with markOneRead), isSlugAvailable, the unreachable 500 in fetchComment, and the `if (!ctx.state.user)` checks behind authMiddleware. 214 backend and 627 frontend tests pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
113 lines
3.6 KiB
TypeScript
113 lines
3.6 KiB
TypeScript
import { stubNetwork } from "../helpers.ts";
|
||
import { assert, assertEquals, assertFalse, assertRejects } from "@std/assert";
|
||
import {
|
||
fetchWithTimeout,
|
||
isValidHttpUrl,
|
||
readTextCapped,
|
||
} from "../../remote/fetch.ts";
|
||
|
||
Deno.test("isValidHttpUrl: http(s) to public hosts, or our own pages", () => {
|
||
assert(isValidHttpUrl("https://example.com/x"));
|
||
assert(isValidHttpUrl("http://gerbeur.test/dumps/abc"));
|
||
assertFalse(isValidHttpUrl("http://localhost:8000/"));
|
||
assertFalse(isValidHttpUrl("http://10.0.0.1/"));
|
||
assertFalse(isValidHttpUrl("file:///etc/passwd"));
|
||
assertFalse(isValidHttpUrl("nope"));
|
||
});
|
||
|
||
Deno.test("fetchWithTimeout: the deadline covers a body that never ends", async () => {
|
||
// Headers at once, then a trickle that never finishes: the read must fail
|
||
// at the deadline rather than hold the request open.
|
||
using _net = stubNetwork((_url, init) =>
|
||
new Response(
|
||
new ReadableStream({
|
||
start(controller) {
|
||
controller.enqueue(new TextEncoder().encode("<html>"));
|
||
init?.signal?.addEventListener(
|
||
"abort",
|
||
() => controller.error(new DOMException("aborted", "AbortError")),
|
||
);
|
||
},
|
||
}),
|
||
{ headers: { "content-type": "text/html" } },
|
||
)
|
||
);
|
||
const res = await fetchWithTimeout("https://example.com/slow", 50);
|
||
await assertRejects(() => res.text());
|
||
});
|
||
|
||
Deno.test("readTextCapped: stops reading at the cap", async () => {
|
||
let pulled = 0;
|
||
const body = new ReadableStream<Uint8Array>({
|
||
pull(controller) {
|
||
pulled++;
|
||
controller.enqueue(new TextEncoder().encode("abcdefghij"));
|
||
},
|
||
});
|
||
const text = await readTextCapped(new Response(body), 25);
|
||
assertEquals(text, "abcdefghijabcdefghijabcde");
|
||
assert(pulled < 10);
|
||
assertEquals(await readTextCapped(new Response("short")), "short");
|
||
});
|
||
|
||
Deno.test("fetchWithTimeout: follows redirects, checking every hop", async () => {
|
||
using net = stubNetwork((url) => {
|
||
if (url.pathname === "/start") {
|
||
return new Response(null, { status: 302, headers: { location: "/end" } });
|
||
}
|
||
if (url.pathname === "/to-private") {
|
||
return new Response(null, {
|
||
status: 301,
|
||
headers: { location: "http://169.254.169.254/latest/meta-data" },
|
||
});
|
||
}
|
||
if (url.pathname === "/loop") {
|
||
return new Response(null, {
|
||
status: 302,
|
||
headers: { location: "/loop" },
|
||
});
|
||
}
|
||
return new Response("done");
|
||
});
|
||
const res = await fetchWithTimeout("https://example.com/start");
|
||
assertEquals(await res.text(), "done");
|
||
assertEquals(net.calls.map((u) => u.pathname), ["/start", "/end"]);
|
||
|
||
await assertRejects(
|
||
() => fetchWithTimeout("https://example.com/to-private"),
|
||
Error,
|
||
"private",
|
||
);
|
||
await assertRejects(
|
||
() => fetchWithTimeout("https://example.com/loop"),
|
||
TypeError,
|
||
"Too many redirects",
|
||
);
|
||
await assertRejects(
|
||
() => fetchWithTimeout("ftp://example.com/"),
|
||
TypeError,
|
||
"Unsupported protocol",
|
||
);
|
||
});
|
||
|
||
Deno.test("readTextCapped: decodes the charset the header or a <meta> declares", async () => {
|
||
const cafe = Uint8Array.from([0x63, 0x61, 0x66, 0xe9]); // "café" in Latin-1
|
||
const page = (contentType: string, head = "") =>
|
||
new Response(
|
||
new Uint8Array([...new TextEncoder().encode(head), ...cafe]),
|
||
{ headers: { "content-type": contentType } },
|
||
);
|
||
assertEquals(
|
||
await readTextCapped(page("text/html; charset=ISO-8859-1")),
|
||
"café",
|
||
);
|
||
assertEquals(
|
||
await readTextCapped(page("text/html", '<meta charset="windows-1252">')),
|
||
'<meta charset="windows-1252">café',
|
||
);
|
||
assertEquals(
|
||
await readTextCapped(page("text/html; charset=nonsense")),
|
||
"caf<61>",
|
||
);
|
||
});
|