Heavy security and file splitting

2026-06-01 20:15:28 -05:00
parent bdbe1a9416
commit ad4355df17
27 changed files with 1540 additions and 1166 deletions
@@ -15,8 +15,6 @@ import (
 	"scratchbox/internal/storage"
 )

-var testStorageKey = []byte("0123456789abcdef0123456789abcdef")
-
 func TestMultipartFileCount(t *testing.T) {
 	t.Parallel()

@@ -61,6 +59,7 @@ func TestNewServerInitializes(t *testing.T) {
 			RateLimitUI:       config.RateLimitConfig{Enabled: false, RequestsPerMinute: 30, Burst: 10},
 			RateLimitAPIRead:  config.RateLimitConfig{Enabled: false, RequestsPerMinute: 30, Burst: 10},
 			RateLimitAPIWrite: config.RateLimitConfig{Enabled: false, RequestsPerMinute: 30, Burst: 10},
+			HSTSEnabled:       true,
 		},
 	}

@@ -132,6 +131,7 @@ func TestWriteCreateErrorBranchesWithConfig(t *testing.T) {
 			RateLimitUI:       config.RateLimitConfig{Enabled: false, RequestsPerMinute: 30, Burst: 10},
 			RateLimitAPIRead:  config.RateLimitConfig{Enabled: false, RequestsPerMinute: 30, Burst: 10},
 			RateLimitAPIWrite: config.RateLimitConfig{Enabled: false, RequestsPerMinute: 30, Burst: 10},
+			HSTSEnabled:       true,
 		},
 	}
 	if _, err := NewServer(cfg, store, log.New(io.Discard, "", 0), log.New(io.Discard, "", 0)); err != nil {
@@ -147,3 +147,41 @@ func containsAll(haystack string, needles ...string) bool {
 	}
 	return true
 }
+
+// TestInjectMetaEscapesSpecialChars exercises the server-side meta injection
+// (used for /s/{id} and 410 pages) with filenames/titles containing HTML special
+// chars. This provides basic coverage/golden-like check for the replace+escape
+// logic against the exact literals in the committed static shell (addresses
+// fragility note without changing to full template).
+func TestInjectMetaEscapesSpecialChars(t *testing.T) {
+	t.Parallel()
+
+	// Minimal shell containing exactly the replace targets used by injectMeta.
+	// (Real index.html from Vite is larger but uses these literal strings.)
+	shell := []byte(`<!doctype html>
+<html><head>
+<title>Scratchbox</title>
+<meta property="og:title" content="Scratchbox" />
+<meta name="twitter:title" content="Scratchbox" />
+<meta name="description" content="Minimal temporary file sharing. Upload once, share the link, auto-expires." />
+<meta property="og:description" content="Minimal temporary file sharing. Upload once, share the link, auto-expires." />
+<meta name="twitter:description" content="Minimal temporary file sharing. Upload once, share the link, auto-expires." />
+</head><body></body></html>`)
+
+	tricky := `report & "notes" <2026> 'foo'`
+	gotBytes := injectMeta(shell, tricky, tricky, tricky)
+	got := string(gotBytes)
+
+	// Must have escaped the specials.
+	if !strings.Contains(got, `&amp;`) || !strings.Contains(got, `&lt;`) || !strings.Contains(got, `&gt;`) || !strings.Contains(got, `&quot;`) {
+		t.Fatalf("injectMeta did not escape specials in output: %q", got)
+	}
+	// Title etc updated (escaped form present).
+	if !strings.Contains(got, `report &amp; &quot;notes&quot; &lt;2026&gt;`) {
+		t.Fatalf("injectMeta title not updated or badly escaped: %q", got)
+	}
+	// Original static should be gone (count=1 replaces).
+	if strings.Contains(got, `<title>Scratchbox</title>`) {
+		t.Fatalf("static title not replaced")
+	}
+}