mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtter
20ab04c5bd
archiver v8 changed its default export, breaking all ZIP-producing tools (pdf-to-image, split, batch, favicon, bulk-rename, svg-to-raster). Reverted to v7 -- the lodash vulnerability via archiver is _.template which is never called directly. @fastify/static v9 has breaking changes incompatible with the current static file serving setup. Reverted to v8 -- the path traversal CVEs in v8 are mitigated by the existing path traversal guards in files.ts. Updated edge-cases test to expect 400 for >64KB settings payloads (new security limit).
781 lines
30 KiB
TypeScript
781 lines
30 KiB
TypeScript
/**
|
|
* Edge-case integration tests for the SnapOtter image API.
|
|
*
|
|
* Tests unusual but valid inputs: empty files, tiny images, wrong extensions,
|
|
* extreme filenames, missing/empty settings, and unknown fields.
|
|
*/
|
|
|
|
import { readFileSync } from "node:fs";
|
|
import { join } from "node:path";
|
|
import { afterAll, beforeAll, describe, expect, it } from "vitest";
|
|
import { buildTestApp, createMultipartPayload, loginAsAdmin, type TestApp } from "./test-server.js";
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Fixtures
|
|
// ---------------------------------------------------------------------------
|
|
const FIXTURES = join(__dirname, "..", "fixtures");
|
|
const PNG_200x150 = readFileSync(join(FIXTURES, "test-200x150.png"));
|
|
const PNG_1x1 = readFileSync(join(FIXTURES, "test-1x1.png"));
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Shared state
|
|
// ---------------------------------------------------------------------------
|
|
let testApp: TestApp;
|
|
let app: TestApp["app"];
|
|
let adminToken: string;
|
|
|
|
beforeAll(async () => {
|
|
testApp = await buildTestApp();
|
|
app = testApp.app;
|
|
adminToken = await loginAsAdmin(app);
|
|
}, 30_000);
|
|
|
|
afterAll(async () => {
|
|
await testApp.cleanup();
|
|
}, 10_000);
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// ZERO-BYTE AND EMPTY FILES
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
describe("Zero-byte / empty file uploads", () => {
|
|
it("rejects a zero-byte file with 400", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "empty.png", content: Buffer.alloc(0), contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(400);
|
|
const json = JSON.parse(res.body);
|
|
expect(json.error).toBeDefined();
|
|
});
|
|
|
|
it("rejects a null-byte-only buffer with 400", async () => {
|
|
const nullBuffer = Buffer.alloc(1024); // all zeroes
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "nulls.png", content: nullBuffer, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(400);
|
|
});
|
|
});
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// 1x1 PIXEL IMAGE — MINIMUM DIMENSION
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
describe("1x1 pixel image handling", () => {
|
|
it("resizes a 1x1 image without crashing", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "tiny.png", content: PNG_1x1, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ width: 50, height: 50 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
|
|
it("crops a 1x1 image gracefully", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "tiny.png", content: PNG_1x1, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ left: 0, top: 0, width: 1, height: 1 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/crop",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// Should succeed or fail gracefully (not crash)
|
|
expect([200, 422]).toContain(res.statusCode);
|
|
});
|
|
|
|
it("rotates a 1x1 image gracefully", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "tiny.png", content: PNG_1x1, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ angle: 90 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/rotate",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
});
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// WRONG EXTENSION — FORMAT DETECTION
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
describe("Wrong file extension (magic byte detection)", () => {
|
|
it("detects actual PNG format when filename says .jpg", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{
|
|
name: "file",
|
|
filename: "actually-a-png.jpg",
|
|
content: PNG_200x150,
|
|
contentType: "image/jpeg",
|
|
},
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// Should detect PNG via magic bytes and process successfully
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
});
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// EXTREME FILENAMES
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
describe("Extreme filenames", () => {
|
|
it("handles a 500-character filename without crashing", async () => {
|
|
const longName = `${"a".repeat(490)}.png`;
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: longName, content: PNG_200x150, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
|
|
it("handles a Unicode filename without crashing", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "画像テスト.png", content: PNG_200x150, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
|
|
it("handles special characters in filename", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{
|
|
name: "file",
|
|
filename: "test file (1) [copy].png",
|
|
content: PNG_200x150,
|
|
contentType: "image/png",
|
|
},
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
|
|
it("sanitizes path traversal in filename", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{
|
|
name: "file",
|
|
filename: "../../../etc/passwd.png",
|
|
content: PNG_200x150,
|
|
contentType: "image/png",
|
|
},
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// Should succeed — filename gets sanitized by sanitizeFilename()
|
|
expect(res.statusCode).toBe(200);
|
|
const json = JSON.parse(res.body);
|
|
// Download URL should not contain path traversal
|
|
expect(json.downloadUrl).not.toContain("..");
|
|
});
|
|
});
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// SETTINGS EDGE CASES
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
describe("Settings field edge cases", () => {
|
|
it("uses defaults when no settings field is provided", async () => {
|
|
// Resize without settings — should use Zod defaults or return 400
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "test.png", content: PNG_200x150, contentType: "image/png" },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// Resize with no width/height/percentage passes Zod validation (all fields
|
|
// are optional with defaults), but Sharp may fail at processing time (422).
|
|
// Either way, should not crash.
|
|
expect([200, 400, 422]).toContain(res.statusCode);
|
|
});
|
|
|
|
it("uses defaults when settings is empty JSON object", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "test.png", content: PNG_200x150, contentType: "image/png" },
|
|
{ name: "settings", content: "{}" },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// Empty settings should use Zod defaults — resize with no dimensions
|
|
// may still succeed (no-op) or fail gracefully
|
|
expect([200, 400, 422]).toContain(res.statusCode);
|
|
});
|
|
|
|
it("handles null values in settings gracefully", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "test.png", content: PNG_200x150, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ width: null, height: null }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// Zod should either strip nulls or reject them — should not crash
|
|
expect([200, 400, 422]).toContain(res.statusCode);
|
|
});
|
|
|
|
it("strips or rejects extra unknown fields in settings", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "test.png", content: PNG_200x150, contentType: "image/png" },
|
|
{
|
|
name: "settings",
|
|
content: JSON.stringify({ width: 100, unknownField: "foo", anotherUnknown: 42 }),
|
|
},
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// Zod default behavior strips unknown keys — should succeed
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
});
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// 1x1 PIXEL IMAGE — EXTENDED TOOL COVERAGE
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
describe("1x1 pixel image through additional tools", () => {
|
|
it("compresses a 1x1 image without crashing", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "tiny.png", content: PNG_1x1, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ quality: 50 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/compress",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
|
|
it("gets info for a 1x1 image", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "tiny.png", content: PNG_1x1, contentType: "image/png" },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/info",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
const json = JSON.parse(res.body);
|
|
expect(json.width).toBe(1);
|
|
expect(json.height).toBe(1);
|
|
expect(json.format).toBe("png");
|
|
});
|
|
|
|
it("converts a 1x1 PNG to JPEG without crashing", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "tiny.png", content: PNG_1x1, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ format: "jpeg" }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/convert",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect([200, 400]).toContain(res.statusCode);
|
|
if (res.statusCode === 400) {
|
|
const json = JSON.parse(res.body);
|
|
expect(json.error).toBeDefined();
|
|
}
|
|
});
|
|
});
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// UNICODE AND SPECIAL FILENAMES
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
describe("Unicode and special filenames", () => {
|
|
it("handles emoji in filename", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{
|
|
name: "file",
|
|
filename: "\u{1F3A8}photo.png",
|
|
content: PNG_200x150,
|
|
contentType: "image/png",
|
|
},
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
const json = JSON.parse(res.body);
|
|
expect(json.downloadUrl).toBeDefined();
|
|
});
|
|
|
|
it("handles CJK characters in filename", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{
|
|
name: "file",
|
|
filename: "写真.png",
|
|
content: PNG_200x150,
|
|
contentType: "image/png",
|
|
},
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
|
|
it("handles spaces and special chars in filename", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{
|
|
name: "file",
|
|
filename: "my photo (2).png",
|
|
content: PNG_200x150,
|
|
contentType: "image/png",
|
|
},
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
|
|
it("handles a very long filename (255 chars)", async () => {
|
|
const longName = `${"a".repeat(251)}.png`;
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: longName, content: PNG_200x150, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// Should succeed — sanitizeFilename may truncate but not crash
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
|
|
it("sanitizes path traversal in filename", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{
|
|
name: "file",
|
|
filename: "../../../etc/passwd.png",
|
|
content: PNG_200x150,
|
|
contentType: "image/png",
|
|
},
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
const json = JSON.parse(res.body);
|
|
// Download URL must not contain traversal sequences
|
|
expect(json.downloadUrl).not.toContain("..");
|
|
expect(json.downloadUrl).not.toContain("etc/passwd");
|
|
});
|
|
|
|
it("handles filename with no extension", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{
|
|
name: "file",
|
|
filename: "noextension",
|
|
content: PNG_200x150,
|
|
contentType: "image/png",
|
|
},
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// Should process via magic byte detection regardless of extension
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
|
|
it("handles filename that is only dots", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{
|
|
name: "file",
|
|
filename: "....png",
|
|
content: PNG_200x150,
|
|
contentType: "image/png",
|
|
},
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
});
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// ZERO-BYTE FILES — ADDITIONAL TOOLS
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
describe("Zero-byte file to info and border tools", () => {
|
|
it("rejects a zero-byte file to /api/v1/tools/info with 400", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "empty.png", content: Buffer.alloc(0), contentType: "image/png" },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/info",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(400);
|
|
const json = JSON.parse(res.body);
|
|
expect(json.error).toBeDefined();
|
|
});
|
|
|
|
it("rejects a zero-byte file to /api/v1/tools/sharpening with 400", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "empty.png", content: Buffer.alloc(0), contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ method: "adaptive" }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/sharpening",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(400);
|
|
const json = JSON.parse(res.body);
|
|
expect(json.error).toBeDefined();
|
|
});
|
|
});
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// 1x1 IMAGE — FLIP AND INFO
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
describe("1x1 pixel image through rotate with flip", () => {
|
|
it("rotates and flips a 1x1 image horizontally", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "tiny.png", content: PNG_1x1, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ angle: 0, flipHorizontal: true }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/rotate",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// 0-degree rotation with flip is valid
|
|
expect([200, 400]).toContain(res.statusCode);
|
|
});
|
|
|
|
it("rotates and flips a 1x1 image vertically", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "tiny.png", content: PNG_1x1, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify({ angle: 0, flipVertical: true }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/rotate",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect([200, 400]).toContain(res.statusCode);
|
|
});
|
|
});
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// MULTIPART WITHOUT FILE PART — ONLY SETTINGS
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
describe("Missing file part in multipart request", () => {
|
|
it("rejects resize request with only settings and no file", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "settings", content: JSON.stringify({ width: 100 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(400);
|
|
const json = JSON.parse(res.body);
|
|
expect(json.error).toMatch(/no image/i);
|
|
});
|
|
|
|
it("rejects pipeline execute with only pipeline definition and no file", async () => {
|
|
const pipelineDef = {
|
|
steps: [{ toolId: "resize", settings: { width: 100 } }],
|
|
};
|
|
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "pipeline", content: JSON.stringify(pipelineDef) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/pipeline/execute",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(400);
|
|
const json = JSON.parse(res.body);
|
|
expect(json.error).toMatch(/no image/i);
|
|
});
|
|
});
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// WRONG EXTENSION — ADDITIONAL FORMAT MISMATCHES
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
describe("Wrong extension — additional format mismatches", () => {
|
|
it("handles JPEG data uploaded with .webp extension gracefully", async () => {
|
|
const jpgBuffer = readFileSync(join(FIXTURES, "test-100x100.jpg"));
|
|
|
|
const { body, contentType } = createMultipartPayload([
|
|
{
|
|
name: "file",
|
|
filename: "actually-jpeg.webp",
|
|
content: jpgBuffer,
|
|
contentType: "image/webp",
|
|
},
|
|
{ name: "settings", content: JSON.stringify({ width: 50 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// Sharp detects real format via magic bytes
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
|
|
it("handles WebP data uploaded with .png extension gracefully", async () => {
|
|
const webpBuffer = readFileSync(join(FIXTURES, "test-50x50.webp"));
|
|
|
|
const { body, contentType } = createMultipartPayload([
|
|
{
|
|
name: "file",
|
|
filename: "actually-webp.png",
|
|
content: webpBuffer,
|
|
contentType: "image/png",
|
|
},
|
|
{ name: "settings", content: JSON.stringify({ width: 30 }) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
});
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// SETTINGS WITH EXTREME STRING VALUES
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
describe("Settings with extreme values", () => {
|
|
it("handles resize with Number.MAX_SAFE_INTEGER as width without crashing", async () => {
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "test.png", content: PNG_200x150, contentType: "image/png" },
|
|
{
|
|
name: "settings",
|
|
content: JSON.stringify({ width: Number.MAX_SAFE_INTEGER }),
|
|
},
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// May be rejected by validation (400), fail at processing (422), or
|
|
// even succeed if Sharp clamps — the key assertion is that it does not crash
|
|
expect([200, 400, 422]).toContain(res.statusCode);
|
|
});
|
|
|
|
it("handles deeply nested JSON in settings without crashing", async () => {
|
|
// Build 50-level deep object — should be rejected or flattened by Zod
|
|
let nested: Record<string, unknown> = { width: 100 };
|
|
for (let i = 0; i < 50; i++) {
|
|
nested = { [`level${i}`]: nested };
|
|
}
|
|
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "test.png", content: PNG_200x150, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify(nested) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// Zod strips unknown keys; width is not present at top level so validation
|
|
// may fail or default to empty settings. Must not crash.
|
|
expect([200, 400, 422]).toContain(res.statusCode);
|
|
});
|
|
|
|
it("handles settings with very large JSON string (100KB)", async () => {
|
|
const bigSettings = {
|
|
width: 100,
|
|
padding: "X".repeat(100_000),
|
|
};
|
|
|
|
const { body, contentType } = createMultipartPayload([
|
|
{ name: "file", filename: "test.png", content: PNG_200x150, contentType: "image/png" },
|
|
{ name: "settings", content: JSON.stringify(bigSettings) },
|
|
]);
|
|
|
|
const res = await app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/tools/resize",
|
|
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
|
body,
|
|
});
|
|
|
|
// Settings payload exceeds the 64KB security limit
|
|
expect(res.statusCode).toBe(400);
|
|
});
|
|
});
|