Files
twenty/packages/twenty-server/test/integration/metadata/suites/front-component/failing-front-component-creation.integration-spec.ts
T
Paul Rastoin b8b115f4e3 FileStorageService Dedicated file and folder code flow + integrity check (#20831)
# Introduction

Next handling mimetype integrity check and checksum integrity check for
s3 storage type

Always expecting a trailing end slash when deleting a folder etc

## Application
Uninstalling an application now deletes all its related files

## File storage service
Making a distincton between folder path and file path

## Validation Pipeline

Every file operation in `FileStorageService.buildOnStoragePath` runs
through `validateResourcePath`, which chains three validators in order:

**1. `validateSafeRelativePath`** -- rejects path traversal attacks

| Input | Result | Error |
|---|---|---|
| `../../../etc/passwd` | Rejected | `Resource path must not contain
path traversal (..)` |
| `/etc/passwd` | Rejected | `Resource path must be relative, not
absolute` |
| `file\0.txt` | Rejected | `Resource path contains null bytes` |
| `..\\..\\etc\\passwd` | Rejected | `Resource path must not contain
backslashes` |
| _(empty)_ | Rejected | `Resource path must not be empty` |

**2. `validateFilenameIntegrity`** -- enforces safe characters, length
limits, extension required

| Input | Result | Error |
|---|---|---|
| `my folder/file.mjs` | Rejected | `A path segment contains invalid
characters...` |
| `Makefile` | Rejected | `Filename must have an extension` |
| `aaa...(256 chars).mjs` | Rejected | `A path segment exceeds the
maximum length of 255 characters` |
| `a/b/.../file.mjs` (1025+ chars) | Rejected | `Resource path exceeds
maximum length of 1024 characters` |
| `src/handlers/index.mjs` | Accepted | -- |
| `my-app/my_file.tsx` | Accepted | -- |
| `v1.0/module.config.mjs` | Accepted | -- |

Allowed characters per segment: `a-z`, `A-Z`, `0-9`, `.`, `-`, `_`

**3. `validateResourceExtension`** -- checks extension against the
`FileFolder` allowlist

| Input | FileFolder | Result | Error |
|---|---|---|---|
| `handler.js` | `BuiltLogicFunction` | Rejected | `Invalid file
extension. Allowed extensions: .mjs` |
| `card.tsx` | `BuiltFrontComponent` | Rejected | `Invalid file
extension. Allowed extensions: .mjs` |
| `script.js` | `PublicAsset` | Rejected | `Invalid file extension.
Allowed extensions: .png, .jpg, ...` |
| `index.mjs` | `BuiltLogicFunction` | Accepted | -- |
| `app.tsx` | `Source` | Accepted | -- |
| `photo.png` | `CorePicture` | Accepted | -- (unconfigured folder,
passes through) |

## Consumers

- **`FileStorageService`** -- calls `validateResourcePath`, throws
`FileStorageException` on failure (last-resort defense)
- **Resolver (`uploadApplicationFile`)** -- calls
`validateResourcePath`, throws `ApplicationException` on failure
(user-facing)
- **Flat validators** -- call `validateResourcePath`, push the error to
`validationResult.errors` (non-throwing, collects all errors)

All error messages are translated via Lingui `t` and returned in a
discriminated union `{ isValid: true } | { isValid: false, error: string
}`, letting each consumer decide how to handle failures.
2026-05-25 11:52:54 +00:00

171 lines
5.0 KiB
TypeScript

import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
import { createFrontComponent } from 'test/integration/metadata/suites/front-component/utils/create-front-component.util';
import { seedBuiltFrontComponentFile } from 'test/integration/metadata/suites/front-component/utils/seed-built-front-component-file.util';
import {
type EachTestingContext,
eachTestingContextFilter,
} from 'twenty-shared/testing';
import { type CreateFrontComponentInput } from 'src/engine/metadata-modules/front-component/dtos/create-front-component.input';
type TestContext = {
input: CreateFrontComponentInput;
};
const FAILING_TEST_CASES: EachTestingContext<TestContext>[] = [
{
title: 'when name is empty',
context: {
input: {
name: '',
componentName: 'TestComponent',
sourceComponentPath: 'src/front-components/index.tsx',
builtComponentPath: 'src/front-components/index.mjs',
builtComponentChecksum: 'abc123',
},
},
},
{
title: 'when name is whitespace-only',
context: {
input: {
name: ' ',
componentName: 'TestComponent',
sourceComponentPath: 'src/front-components/index.tsx',
builtComponentPath: 'src/front-components/index.mjs',
builtComponentChecksum: 'abc123',
},
},
},
{
title: 'when builtComponentPath contains path traversal',
context: {
input: {
name: 'TraversalTest',
componentName: 'TraversalTest',
sourceComponentPath: 'src/front-components/index.tsx',
builtComponentPath:
'../../../other-workspace/other-app/BuiltFrontComponent/stolen.mjs',
builtComponentChecksum: 'abc123',
},
},
},
{
title: 'when sourceComponentPath contains path traversal',
context: {
input: {
name: 'TraversalTest',
componentName: 'TraversalTest',
sourceComponentPath: '../../etc/passwd',
builtComponentPath: 'src/front-components/index.mjs',
builtComponentChecksum: 'abc123',
},
},
},
{
title: 'when builtComponentPath is an absolute path',
context: {
input: {
name: 'AbsolutePathTest',
componentName: 'AbsolutePathTest',
sourceComponentPath: 'src/front-components/index.tsx',
builtComponentPath: '/etc/passwd',
builtComponentChecksum: 'abc123',
},
},
},
{
title:
'when builtComponentPath is a folder path without extension (bare UUID)',
context: {
input: {
name: 'FolderPathTest',
componentName: 'FolderPathTest',
sourceComponentPath: 'src/front-components/index.tsx',
builtComponentPath: '8b2df3cc-23ad-4e1b-87fd-f880d4cefd58',
builtComponentChecksum: 'abc123',
},
},
},
{
title:
'when sourceComponentPath is a folder path without extension',
context: {
input: {
name: 'FolderSourcePathTest',
componentName: 'FolderSourcePathTest',
sourceComponentPath: 'src/front-components/my-component',
builtComponentPath: 'src/front-components/index.mjs',
builtComponentChecksum: 'abc123',
},
},
},
{
title:
'when builtComponentPath has an invalid extension (.js instead of .mjs)',
context: {
input: {
name: 'InvalidExtTest',
componentName: 'InvalidExtTest',
sourceComponentPath: 'src/front-components/index.tsx',
builtComponentPath: 'src/front-components/index.js',
builtComponentChecksum: 'abc123',
},
},
},
{
title:
'when sourceComponentPath has an invalid extension (.mjs instead of .ts/.tsx)',
context: {
input: {
name: 'InvalidSourceExtTest',
componentName: 'InvalidSourceExtTest',
sourceComponentPath: 'src/front-components/index.mjs',
builtComponentPath: 'src/front-components/index.mjs',
builtComponentChecksum: 'abc123',
},
},
},
{
title:
'when builtComponentPath has a completely unrelated extension (.pdf)',
context: {
input: {
name: 'PdfExtTest',
componentName: 'PdfExtTest',
sourceComponentPath: 'src/front-components/index.tsx',
builtComponentPath: 'src/front-components/index.pdf',
builtComponentChecksum: 'abc123',
},
},
},
];
describe('Front component creation should fail', () => {
let cleanupBuiltFile: (() => void) | undefined;
beforeAll(async () => {
const { cleanup } = await seedBuiltFrontComponentFile({
builtComponentPath: 'src/front-components/index.mjs',
});
cleanupBuiltFile = cleanup;
});
afterAll(() => {
cleanupBuiltFile?.();
});
it.each(eachTestingContextFilter(FAILING_TEST_CASES))(
'$title',
async ({ context }) => {
const { errors } = await createFrontComponent({
expectToFail: true,
input: context.input,
});
expectOneNotInternalServerErrorSnapshot({ errors });
},
);
});