File size: 1,753 Bytes
3a34cb6 10860d7 3a34cb6 10860d7 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 | import pytest
from pathlib import Path
from fastapi.testclient import TestClient
def test_serve_existing_file(tmp_path, monkeypatch):
"""Returns 200 + file content for a file that exists."""
fake_raw = tmp_path / "raw"
fake_raw.mkdir()
pdf = fake_raw / "report.pdf"
pdf.write_bytes(b"%PDF-1.4 fake")
monkeypatch.setattr("server.main.UPLOAD_DIR", fake_raw)
from server.main import app
client = TestClient(app)
resp = client.get("/api/files/report.pdf")
assert resp.status_code == 200
assert resp.content == b"%PDF-1.4 fake"
def test_serve_missing_file(tmp_path, monkeypatch):
"""Returns 404 for a filename that doesn't exist."""
fake_raw = tmp_path / "raw"
fake_raw.mkdir()
monkeypatch.setattr("server.main.UPLOAD_DIR", fake_raw)
from server.main import app
client = TestClient(app)
resp = client.get("/api/files/does_not_exist.pdf")
assert resp.status_code == 404
def test_serve_blocks_path_traversal(tmp_path, monkeypatch):
"""Path traversal attempts are blocked (by Starlette routing or by is_relative_to handler check)."""
fake_raw = tmp_path / "raw"
fake_raw.mkdir()
monkeypatch.setattr("server.main.UPLOAD_DIR", fake_raw)
from server.main import app
client = TestClient(app)
# Bare ".." — normalized by Starlette routing layer before handler sees it; 404 result
resp = client.get("/api/files/..")
assert resp.status_code in (400, 404), f"Expected 400 or 404, got {resp.status_code}"
# URL-encoded slash — rejected by Starlette routing before handler; 404 result
resp2 = client.get("/api/files/..%2F..%2Fetc%2Fpasswd")
assert resp2.status_code in (400, 404), f"Expected 400 or 404, got {resp2.status_code}"
|