Add test to serve content

2 files changed, 92 insertions, 2 deletions

diff --git a/internal/httpfs/http_fs.go b/internal/httpfs/http_fs.go
index 10e4129f..671ab521 100644
--- a/internal/httpfs/http_fs.go
+++ b/internal/httpfs/http_fs.go
@@ -2,7 +2,6 @@ package httpfs
 
 import (
 	"errors"
-	"fmt"
 	"net/http"
 	"os"
 	"path"
@@ -40,7 +39,6 @@ func (p *fileSystemPaths) Open(name string) (http.File, error) {
 	}
 
 	for _, allowedPath := range p.allowedPaths {
-		fmt.Printf("hasPrefix: %t\n", strings.HasPrefix(absPath, allowedPath+"/"))
 		if strings.HasPrefix(absPath, allowedPath+"/") {
 			return os.Open(absPath)
 		}
diff --git a/internal/httpfs/http_fs_test.go b/internal/httpfs/http_fs_test.go
index c081c401..b8606d9d 100644
--- a/internal/httpfs/http_fs_test.go
+++ b/internal/httpfs/http_fs_test.go
@@ -2,8 +2,13 @@ package httpfs
 
 import (
 	"io/ioutil"
+	"net/http"
+	"net/url"
 	"os"
 	"testing"
+	"time"
+
+	"gitlab.com/gitlab-org/gitlab-pages/internal/httptransport"
 
 	"github.com/stretchr/testify/require"
 )
@@ -75,3 +80,90 @@ func TestFSOpen(t *testing.T) {
 		})
 	}
 }
+
+func TestFileSystemPathCanServeHTTP(t *testing.T) {
+	wd, err := os.Getwd()
+	require.NoError(t, err)
+
+	tests := map[string]struct {
+		path               string
+		fileName           string
+		escapeURL          bool
+		expectedStatusCode int
+		expectedContent    string
+	}{
+		"file_exists_in_path": {
+			path:               wd + "/testdata",
+			fileName:           "file1.txt",
+			expectedStatusCode: http.StatusOK,
+			expectedContent:    "file1.txt\n",
+		},
+		"file_exists_in_sub_dir_path": {
+			path:               wd + "/testdata",
+			fileName:           "subdir/file2.txt",
+			expectedStatusCode: http.StatusOK,
+			expectedContent:    "subdir/file2.txt\n",
+		},
+		"file_not_allowed_in_path": {
+			path:               wd + "/testdata/subdir",
+			fileName:           "../file1.txt",
+			expectedStatusCode: http.StatusForbidden,
+			expectedContent:    "403 Forbidden\n",
+		},
+		"file_does_not_exist": {
+			path:               wd + "/testdata",
+			fileName:           "unknown.txt",
+			expectedStatusCode: http.StatusNotFound,
+			expectedContent:    "404 page not found\n",
+		},
+		"escaped_url_is_invalid": {
+			path:               wd + "/testdata",
+			fileName:           "file1.txt",
+			escapeURL:          true,
+			expectedStatusCode: http.StatusForbidden,
+			expectedContent:    "403 Forbidden\n",
+		},
+		"dot_dot_in_URL": {
+			path:               wd + "/testdata",
+			fileName:           "../testdata/file1.txt",
+			expectedStatusCode: http.StatusOK,
+			expectedContent:    "file1.txt\n",
+		},
+		"dot_dot_in_URL_outside_of_allowed_path": {
+			path:               wd + "/testdata",
+			fileName:           "../file1.txt",
+			expectedStatusCode: http.StatusForbidden,
+			expectedContent:    "403 Forbidden\n",
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			transport := httptransport.NewTransport()
+			transport.RegisterProtocol("file", http.NewFileTransport(NewFileSystemPath([]string{test.path})))
+
+			client := &http.Client{
+				Transport: transport,
+				Timeout:   time.Second,
+			}
+
+			reqURL := "file://" + test.path + "/" + test.fileName
+			if test.escapeURL {
+				reqURL = url.PathEscape(reqURL)
+			}
+
+			req, err := http.NewRequest("GET", reqURL, nil)
+			require.NoError(t, err)
+
+			res, err := client.Do(req)
+			require.NoError(t, err)
+			defer res.Body.Close()
+
+			require.Equal(t, test.expectedStatusCode, res.StatusCode)
+			content, err := ioutil.ReadAll(res.Body)
+			require.NoError(t, err)
+
+			require.Equal(t, test.expectedContent, string(content))
+		})
+	}
+}