b8b115f4e3
# Introduction
Next handling mimetype integrity check and checksum integrity check for
s3 storage type
Always expecting a trailing end slash when deleting a folder etc
## Application
Uninstalling an application now deletes all its related files
## File storage service
Making a distincton between folder path and file path
## Validation Pipeline
Every file operation in `FileStorageService.buildOnStoragePath` runs
through `validateResourcePath`, which chains three validators in order:
**1. `validateSafeRelativePath`** -- rejects path traversal attacks
| Input | Result | Error |
|---|---|---|
| `../../../etc/passwd` | Rejected | `Resource path must not contain
path traversal (..)` |
| `/etc/passwd` | Rejected | `Resource path must be relative, not
absolute` |
| `file\0.txt` | Rejected | `Resource path contains null bytes` |
| `..\\..\\etc\\passwd` | Rejected | `Resource path must not contain
backslashes` |
| _(empty)_ | Rejected | `Resource path must not be empty` |
**2. `validateFilenameIntegrity`** -- enforces safe characters, length
limits, extension required
| Input | Result | Error |
|---|---|---|
| `my folder/file.mjs` | Rejected | `A path segment contains invalid
characters...` |
| `Makefile` | Rejected | `Filename must have an extension` |
| `aaa...(256 chars).mjs` | Rejected | `A path segment exceeds the
maximum length of 255 characters` |
| `a/b/.../file.mjs` (1025+ chars) | Rejected | `Resource path exceeds
maximum length of 1024 characters` |
| `src/handlers/index.mjs` | Accepted | -- |
| `my-app/my_file.tsx` | Accepted | -- |
| `v1.0/module.config.mjs` | Accepted | -- |
Allowed characters per segment: `a-z`, `A-Z`, `0-9`, `.`, `-`, `_`
**3. `validateResourceExtension`** -- checks extension against the
`FileFolder` allowlist
| Input | FileFolder | Result | Error |
|---|---|---|---|
| `handler.js` | `BuiltLogicFunction` | Rejected | `Invalid file
extension. Allowed extensions: .mjs` |
| `card.tsx` | `BuiltFrontComponent` | Rejected | `Invalid file
extension. Allowed extensions: .mjs` |
| `script.js` | `PublicAsset` | Rejected | `Invalid file extension.
Allowed extensions: .png, .jpg, ...` |
| `index.mjs` | `BuiltLogicFunction` | Accepted | -- |
| `app.tsx` | `Source` | Accepted | -- |
| `photo.png` | `CorePicture` | Accepted | -- (unconfigured folder,
passes through) |
## Consumers
- **`FileStorageService`** -- calls `validateResourcePath`, throws
`FileStorageException` on failure (last-resort defense)
- **Resolver (`uploadApplicationFile`)** -- calls
`validateResourcePath`, throws `ApplicationException` on failure
(user-facing)
- **Flat validators** -- call `validateResourcePath`, push the error to
`validationResult.errors` (non-throwing, collects all errors)
All error messages are translated via Lingui `t` and returned in a
discriminated union `{ isValid: true } | { isValid: false, error: string
}`, letting each consumer decide how to handle failures.
171 lines
5.0 KiB
TypeScript
171 lines
5.0 KiB
TypeScript
import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
|
|
import { createFrontComponent } from 'test/integration/metadata/suites/front-component/utils/create-front-component.util';
|
|
import { seedBuiltFrontComponentFile } from 'test/integration/metadata/suites/front-component/utils/seed-built-front-component-file.util';
|
|
import {
|
|
type EachTestingContext,
|
|
eachTestingContextFilter,
|
|
} from 'twenty-shared/testing';
|
|
|
|
import { type CreateFrontComponentInput } from 'src/engine/metadata-modules/front-component/dtos/create-front-component.input';
|
|
|
|
type TestContext = {
|
|
input: CreateFrontComponentInput;
|
|
};
|
|
|
|
const FAILING_TEST_CASES: EachTestingContext<TestContext>[] = [
|
|
{
|
|
title: 'when name is empty',
|
|
context: {
|
|
input: {
|
|
name: '',
|
|
componentName: 'TestComponent',
|
|
sourceComponentPath: 'src/front-components/index.tsx',
|
|
builtComponentPath: 'src/front-components/index.mjs',
|
|
builtComponentChecksum: 'abc123',
|
|
},
|
|
},
|
|
},
|
|
{
|
|
title: 'when name is whitespace-only',
|
|
context: {
|
|
input: {
|
|
name: ' ',
|
|
componentName: 'TestComponent',
|
|
sourceComponentPath: 'src/front-components/index.tsx',
|
|
builtComponentPath: 'src/front-components/index.mjs',
|
|
builtComponentChecksum: 'abc123',
|
|
},
|
|
},
|
|
},
|
|
{
|
|
title: 'when builtComponentPath contains path traversal',
|
|
context: {
|
|
input: {
|
|
name: 'TraversalTest',
|
|
componentName: 'TraversalTest',
|
|
sourceComponentPath: 'src/front-components/index.tsx',
|
|
builtComponentPath:
|
|
'../../../other-workspace/other-app/BuiltFrontComponent/stolen.mjs',
|
|
builtComponentChecksum: 'abc123',
|
|
},
|
|
},
|
|
},
|
|
{
|
|
title: 'when sourceComponentPath contains path traversal',
|
|
context: {
|
|
input: {
|
|
name: 'TraversalTest',
|
|
componentName: 'TraversalTest',
|
|
sourceComponentPath: '../../etc/passwd',
|
|
builtComponentPath: 'src/front-components/index.mjs',
|
|
builtComponentChecksum: 'abc123',
|
|
},
|
|
},
|
|
},
|
|
{
|
|
title: 'when builtComponentPath is an absolute path',
|
|
context: {
|
|
input: {
|
|
name: 'AbsolutePathTest',
|
|
componentName: 'AbsolutePathTest',
|
|
sourceComponentPath: 'src/front-components/index.tsx',
|
|
builtComponentPath: '/etc/passwd',
|
|
builtComponentChecksum: 'abc123',
|
|
},
|
|
},
|
|
},
|
|
{
|
|
title:
|
|
'when builtComponentPath is a folder path without extension (bare UUID)',
|
|
context: {
|
|
input: {
|
|
name: 'FolderPathTest',
|
|
componentName: 'FolderPathTest',
|
|
sourceComponentPath: 'src/front-components/index.tsx',
|
|
builtComponentPath: '8b2df3cc-23ad-4e1b-87fd-f880d4cefd58',
|
|
builtComponentChecksum: 'abc123',
|
|
},
|
|
},
|
|
},
|
|
{
|
|
title:
|
|
'when sourceComponentPath is a folder path without extension',
|
|
context: {
|
|
input: {
|
|
name: 'FolderSourcePathTest',
|
|
componentName: 'FolderSourcePathTest',
|
|
sourceComponentPath: 'src/front-components/my-component',
|
|
builtComponentPath: 'src/front-components/index.mjs',
|
|
builtComponentChecksum: 'abc123',
|
|
},
|
|
},
|
|
},
|
|
{
|
|
title:
|
|
'when builtComponentPath has an invalid extension (.js instead of .mjs)',
|
|
context: {
|
|
input: {
|
|
name: 'InvalidExtTest',
|
|
componentName: 'InvalidExtTest',
|
|
sourceComponentPath: 'src/front-components/index.tsx',
|
|
builtComponentPath: 'src/front-components/index.js',
|
|
builtComponentChecksum: 'abc123',
|
|
},
|
|
},
|
|
},
|
|
{
|
|
title:
|
|
'when sourceComponentPath has an invalid extension (.mjs instead of .ts/.tsx)',
|
|
context: {
|
|
input: {
|
|
name: 'InvalidSourceExtTest',
|
|
componentName: 'InvalidSourceExtTest',
|
|
sourceComponentPath: 'src/front-components/index.mjs',
|
|
builtComponentPath: 'src/front-components/index.mjs',
|
|
builtComponentChecksum: 'abc123',
|
|
},
|
|
},
|
|
},
|
|
{
|
|
title:
|
|
'when builtComponentPath has a completely unrelated extension (.pdf)',
|
|
context: {
|
|
input: {
|
|
name: 'PdfExtTest',
|
|
componentName: 'PdfExtTest',
|
|
sourceComponentPath: 'src/front-components/index.tsx',
|
|
builtComponentPath: 'src/front-components/index.pdf',
|
|
builtComponentChecksum: 'abc123',
|
|
},
|
|
},
|
|
},
|
|
];
|
|
|
|
describe('Front component creation should fail', () => {
|
|
let cleanupBuiltFile: (() => void) | undefined;
|
|
|
|
beforeAll(async () => {
|
|
const { cleanup } = await seedBuiltFrontComponentFile({
|
|
builtComponentPath: 'src/front-components/index.mjs',
|
|
});
|
|
|
|
cleanupBuiltFile = cleanup;
|
|
});
|
|
|
|
afterAll(() => {
|
|
cleanupBuiltFile?.();
|
|
});
|
|
|
|
it.each(eachTestingContextFilter(FAILING_TEST_CASES))(
|
|
'$title',
|
|
async ({ context }) => {
|
|
const { errors } = await createFrontComponent({
|
|
expectToFail: true,
|
|
input: context.input,
|
|
});
|
|
|
|
expectOneNotInternalServerErrorSnapshot({ errors });
|
|
},
|
|
);
|
|
});
|