1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
# frozen_string_literal: true
require 'spec_helper'
RSpec.describe Gitlab::GithubImport::AttachmentsDownloader, feature_category: :importers do
subject(:downloader) { described_class.new(file_url) }
let_it_be(:file_url) { 'https://example.com/avatar.png' }
let_it_be(:content_type) { 'application/octet-stream' }
let(:content_length) { 1000 }
let(:chunk_double) { instance_double(HTTParty::ResponseFragment, code: 200) }
let(:headers_double) do
instance_double(
HTTParty::Response,
code: 200,
success?: true,
parsed_response: {},
headers: {
'content-length' => content_length,
'content-type' => content_type
}
)
end
describe '#perform' do
before do
allow(Gitlab::HTTP).to receive(:perform_request)
.with(Net::HTTP::Get, file_url, stream_body: true).and_yield(chunk_double)
allow(Gitlab::HTTP).to receive(:perform_request)
.with(Net::HTTP::Head, file_url, {}).and_return(headers_double)
end
context 'when file valid' do
it 'downloads file' do
file = downloader.perform
expect(File.exist?(file.path)).to eq(true)
end
end
context 'when file shares multiple hard links' do
let(:tmpdir) { Dir.mktmpdir }
let(:hard_link) { File.join(tmpdir, 'hard_link') }
before do
existing_file = File.join(tmpdir, 'file.txt')
FileUtils.touch(existing_file)
FileUtils.link(existing_file, hard_link)
allow(downloader).to receive(:filepath).and_return(hard_link)
end
it 'raises expected exception' do
expect(Gitlab::Utils::FileInfo).to receive(:linked?).with(hard_link).and_call_original
expect { downloader.perform }.to raise_exception(
described_class::DownloadError,
'Invalid downloaded file'
)
end
end
context 'when filename is malicious' do
let_it_be(:file_url) { 'https://example.com/ava%2F..%2Ftar.png' }
it 'raises expected exception' do
expect { downloader.perform }.to raise_exception(
Gitlab::PathTraversal::PathTraversalAttackError,
'Invalid path'
)
end
end
context 'when file size exceeds limit' do
let(:content_length) { 26.megabytes }
it 'raises expected exception' do
expect { downloader.perform }.to raise_exception(
Gitlab::GithubImport::AttachmentsDownloader::DownloadError,
'File size 26 MiB exceeds limit of 25 MiB'
)
end
end
context 'when file name length exceeds limit' do
before do
stub_const('BulkImports::FileDownloads::FilenameFetch::FILENAME_SIZE_LIMIT', 2)
end
it 'chops filename' do
file = downloader.perform
expect(File.exist?(file.path)).to eq(true)
expect(File.basename(file)).to eq('av.png')
end
end
end
describe '#delete' do
let(:tmp_dir_path) { File.join(Dir.tmpdir, 'github_attachments_test') }
let(:file) do
downloader.mkdir_p(tmp_dir_path)
file = File.open("#{tmp_dir_path}/test.txt", 'wb')
file.write('foo')
file.close
file
end
before do
allow(downloader).to receive(:filepath).and_return(file.path)
end
it 'removes file with parent folder' do
downloader.delete
expect(Dir.exist?(tmp_dir_path)).to eq false
end
end
end
|
