File size: 1,753 Bytes
3a34cb6
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
10860d7
3a34cb6
 
 
 
 
 
 
10860d7
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
import pytest
from pathlib import Path
from fastapi.testclient import TestClient


def test_serve_existing_file(tmp_path, monkeypatch):
    """Returns 200 + file content for a file that exists."""
    fake_raw = tmp_path / "raw"
    fake_raw.mkdir()
    pdf = fake_raw / "report.pdf"
    pdf.write_bytes(b"%PDF-1.4 fake")

    monkeypatch.setattr("server.main.UPLOAD_DIR", fake_raw)

    from server.main import app
    client = TestClient(app)
    resp = client.get("/api/files/report.pdf")
    assert resp.status_code == 200
    assert resp.content == b"%PDF-1.4 fake"


def test_serve_missing_file(tmp_path, monkeypatch):
    """Returns 404 for a filename that doesn't exist."""
    fake_raw = tmp_path / "raw"
    fake_raw.mkdir()

    monkeypatch.setattr("server.main.UPLOAD_DIR", fake_raw)

    from server.main import app
    client = TestClient(app)
    resp = client.get("/api/files/does_not_exist.pdf")
    assert resp.status_code == 404


def test_serve_blocks_path_traversal(tmp_path, monkeypatch):
    """Path traversal attempts are blocked (by Starlette routing or by is_relative_to handler check)."""
    fake_raw = tmp_path / "raw"
    fake_raw.mkdir()

    monkeypatch.setattr("server.main.UPLOAD_DIR", fake_raw)

    from server.main import app
    client = TestClient(app)

    # Bare ".." — normalized by Starlette routing layer before handler sees it; 404 result
    resp = client.get("/api/files/..")
    assert resp.status_code in (400, 404), f"Expected 400 or 404, got {resp.status_code}"

    # URL-encoded slash — rejected by Starlette routing before handler; 404 result
    resp2 = client.get("/api/files/..%2F..%2Fetc%2Fpasswd")
    assert resp2.status_code in (400, 404), f"Expected 400 or 404, got {resp2.status_code}"