express-fileupload/test/utilities.spec.js

'use strict';

const assert = require('assert');
const path = require('path');
const fs = require('fs');
const md5 = require('md5');
const server = require('./server');
const fileDir = server.fileDir;
const uploadDir = server.uploadDir;
const {
  debugLog,
  isFunc,
  errorFunc,
  getTempFilename,
  buildOptions,
  buildFields,
  checkAndMakeDir,
  deleteFile,
  copyFile,
  saveBufferToFile,
  parseFileName,
  uriDecodeFileName,
  isSafeFromPollution
} = require('../lib/utilities');

const mockFile = 'basketball.png';
const mockBuffer = fs.readFileSync(path.join(fileDir, mockFile));
const mockHash = md5(mockBuffer);


describe('Test of the utilities functions', function() {
  beforeEach(function() {
    server.clearUploadsDir();
  });
  //debugLog tests
  describe('Test debugLog function', () => {

    let testMessage = 'Test message';

    it('debugLog returns false if no options passed', () => {
      assert.equal(debugLog(null, testMessage), false);
    });

    it('debugLog returns false if option debug is false', () => {
      assert.equal(debugLog({debug: false}, testMessage), false);
    });

    it('debugLog returns true if option debug is true', () => {
      assert.equal(debugLog({debug: true}, testMessage), true);
    });

  });
  //isFunc tests
  describe('Test isFunc function', () => {

    it('isFunc returns true if function passed', () => assert.equal(isFunc(()=>{}), true));

    it('isFunc returns false if null passed', function() {
      assert.equal(isFunc(null), false);
    });

    it('isFunc returns false if undefined passed', function() {
      assert.equal(isFunc(undefined), false);
    });

    it('isFunc returns false if object passed', function() {
      assert.equal(isFunc({}), false);
    });

    it('isFunc returns false if array passed', function() {
      assert.equal(isFunc([]), false);
    });
  });
  //errorFunc tests
  describe('Test errorFunc function', () => {

    const resolve = () => 'success';
    const reject = () => 'error';

    it('errorFunc returns resolve if reject function has not been passed', () => {
      let result = errorFunc(resolve);
      assert.equal(result(), 'success');
    });

    it('errorFunc returns reject if reject function has been passed', () => {
      let result = errorFunc(resolve, reject);
      assert.equal(result(), 'error');
    });

  });
  //getTempFilename tests
  describe('Test getTempFilename function', () => {

    const nameRegexp = /tmp-\d{1,5}-\d{1,}/;

    it('getTempFilename result matches regexp /tmp-d{1,5}-d{1,}/', () => {

      let errCounter = 0;
      let tempName = '';
      for (var i = 0; i < 65537; i++) {
        tempName = getTempFilename();
        if (!nameRegexp.test(tempName)) errCounter ++;
      }

      assert.equal(errCounter, 0);
    });

    it('getTempFilename current and previous results are not equal', () => {

      let errCounter = 0;
      let tempName = '';
      let previousName = '';
      for (var i = 0; i < 65537; i++) {
        previousName = tempName;
        tempName = getTempFilename();
        if (previousName === tempName) errCounter ++;
      }

      assert.equal(errCounter, 0);
    });

  });
  //parseFileName
  describe('Test parseFileName function', () => {

    it('Does nothing to your filename when disabled.', () => {
      const opts = {safeFileNames: false};
      const name = 'my$Invalid#fileName.png123';
      const expected = 'my$Invalid#fileName.png123';
      let result = parseFileName(opts, name);
      assert.equal(result, expected);
    });

    it('Cuts of file name length if it more then 255 chars.', () => {
      const name = 'a'.repeat(300);
      const result = parseFileName({}, name);
      assert.equal(result.length, 255);
    });

    it(
      'Strips away all non-alphanumeric characters (excluding hyphens/underscores) when enabled.',
      () => {
        const opts = {safeFileNames: true};
        const name = 'my$Invalid#fileName.png123';
        const expected = 'myInvalidfileNamepng123';
        let result = parseFileName(opts, name);
        assert.equal(result, expected);
      });

    it(
      'Strips away all non-alphanumeric chars when preserveExtension: true for a name without dots',
      () => {
        const opts = {safeFileNames: true, preserveExtension: true};
        const name = 'my$Invalid#fileName';
        const expected = 'myInvalidfileName';
        let result = parseFileName(opts, name);
        assert.equal(result, expected);
      });

    it('Accepts a regex for stripping (decidedly) "invalid" characters from filename.', () => {
      const opts = {safeFileNames: /[$#]/g};
      const name = 'my$Invalid#fileName.png123';
      const expected = 'myInvalidfileName.png123';
      let result = parseFileName(opts, name);
      assert.equal(result, expected);
    });

    it(
      'Returns correct filename if name contains dots characters and preserveExtension: true.',
      () => {
        const opts = {safeFileNames: true, preserveExtension: true};
        const name = 'basket.ball.png';
        const expected = 'basketball.png';
        let result = parseFileName(opts, name);
        assert.equal(result, expected);
      });

    it('Returns a temporary file name if name argument is empty.', () => {
      const opts = {safeFileNames: false};
      const result = parseFileName(opts);
      assert.equal(typeof result, 'string');
    });

  });
  //buildOptions tests
  describe('Test buildOptions function', () => {

    const source = { option1: '1', option2: '2' };
    const sourceAddon = { option3: '3'};
    const expected = { option1: '1', option2: '2' };
    const expectedAddon = { option1: '1', option2: '2', option3: '3'};

    it('buildOptions returns and equal object to the object which was paased', () => {
      let result = buildOptions(source);
      assert.deepStrictEqual(result, source);
    });

    it('buildOptions doesnt add non object or null arguments to the result', () => {
      let result = buildOptions(source, 2, '3', null);
      assert.deepStrictEqual(result, expected);
    });

    it('buildOptions adds value to the result from the several source argumets', () => {
      let result = buildOptions(source, sourceAddon);
      assert.deepStrictEqual(result, expectedAddon);
    });

  });
  //buildFields tests
  describe('Test buildOptions function', () => {

    it('buildFields does nothing if null value has been passed', () => {
      let fields = null;
      fields = buildFields(fields, 'test', null);
      assert.equal(fields, null);
    });

  });
  //checkAndMakeDir tests
  describe('Test checkAndMakeDir function', () => {
    //
    it('checkAndMakeDir returns false if upload options object was not set', () => {
      assert.equal(checkAndMakeDir(), false);
    });
    //
    it('checkAndMakeDir returns false if upload option createParentPath was not set', () => {
      assert.equal(checkAndMakeDir({}), false);
    });
    //
    it('checkAndMakeDir returns false if filePath was not set', () => {
      assert.equal(checkAndMakeDir({createParentPath: true}), false);
    });
    //
    it('checkAndMakeDir return true if path to the file already exists', ()=>{
      const filePath = path.join(uploadDir, 'testfile');
      assert.equal(checkAndMakeDir({createParentPath: true}, filePath), true);
    });
    //
    it('checkAndMakeDir creates a dir if path to the file not exists', ()=>{
      const parentDir = path.join(uploadDir, 'testfolder');
      const filePath = path.join(parentDir, 'testfile');
      assert.equal(checkAndMakeDir({createParentPath: true}, filePath), true);
      assert.equal(fs.existsSync(parentDir), true, 'creates parent directory');
      assert.equal(fs.existsSync(filePath), false, 'does not create file');
    });
    //
    it('checkAndMakeDir creates a dir recursively if path to the file not exists', ()=>{
      const parentDir = path.join(uploadDir, 'testfolder', 'testsubfolder');
      const filePath = path.join(parentDir, 'testfile');
      assert.equal(checkAndMakeDir({createParentPath: true}, filePath), true);
      assert.equal(fs.existsSync(parentDir), true, 'creates parent directory');
      assert.equal(fs.existsSync(filePath), false, 'does not create file');
    });
  });
  //saveBufferToFile tests
  describe('Test saveBufferToFile function', function(){
    beforeEach(function() {
      server.clearUploadsDir();
    });

    it('Save buffer to a file', function(done) {
      let filePath = path.join(uploadDir, mockFile);
      saveBufferToFile(mockBuffer, filePath, function(err){
        if (err) {
          return done(err);
        }
        fs.stat(filePath, done);
      });
    });

    it('Failed if not a buffer passed', function(done) {
      let filePath = path.join(uploadDir, mockFile);
      saveBufferToFile(undefined, filePath, function(err){
        if (err) {
          return done();
        }
      });
    });

    it('Failed if wrong path passed', function(done) {
      let filePath = '';
      saveBufferToFile(mockFile, filePath, function(err){
        if (err) {
          return done();
        }
      });
    });
  });

  describe('Test deleteFile function', function(){
    beforeEach(function() {
      server.clearUploadsDir();
    });

    it('Failed if nonexistent file passed', function(done){
      let filePath = path.join(uploadDir, getTempFilename());

      deleteFile(filePath, function(err){
        if (err) {
          return done();
        }
      });
    });

    it('Delete a file', function(done){
      let srcPath = path.join(fileDir, mockFile);
      let dstPath = path.join(uploadDir, getTempFilename());

      //copy a file
      copyFile(srcPath, dstPath, function(err){
        if (err) {
          return done(err);
        }
        fs.stat(dstPath, (err)=>{
          if (err){
            return done(err);
          }
          // delete a file
          deleteFile(dstPath, function(err){
            if (err) {
              return done(err);
            }

            fs.stat(dstPath, (err)=>{
              if (err){
                return done();
              }

              //error if a file still exist
              done(err);
            });
          });
        });
      });
    });

  });

  describe('Test copyFile function', function(){
    beforeEach(function() {
      server.clearUploadsDir();
    });

    it('Copy a file and check a hash', function(done) {
      let srcPath = path.join(fileDir, mockFile);
      let dstPath = path.join(uploadDir, mockFile);

      copyFile(srcPath, dstPath, function(err){
        if (err) {
          return done(err);
        }
        fs.stat(dstPath, (err)=>{
          if (err){
            return done(err);
          }
          //Match source and destination files hash.
          let fileBuffer = fs.readFileSync(dstPath);
          let fileHash = md5(fileBuffer);
          return (fileHash === mockHash) ? done() : done(err);
        });
      });
    });

    it('Failed if wrong source file path passed', function(done){
      let srcPath = path.join(fileDir, 'unknown');
      let dstPath = path.join(uploadDir, mockFile);

      copyFile(srcPath, dstPath, function(err){
        if (err) {
          return done();
        }
      });
    });

    it('Failed if wrong destination file path passed', function(done){
      let srcPath = path.join(fileDir, 'unknown');
      let dstPath = path.join('unknown', 'unknown');

      copyFile(srcPath, dstPath, function(err){
        if (err) {
          return done();
        }
      });
    });
  });

  describe('Test uriDecodeFileName function', function() {
    const testData = [
      { enc: 'test%22filename', dec: 'test"filename' },
      { enc: 'test%60filename', dec: 'test`filename' },
      { enc: '%3Fx%3Dtest%22filename', dec: '?x=test"filename'}
    ];

    // Test decoding if uriDecodeFileNames: true.
    testData.forEach((testName) => {
      const opts = { uriDecodeFileNames: true };
      it(`Return ${testName.dec} for input ${testName.enc} if uriDecodeFileNames: true`, () => {
        assert.equal(uriDecodeFileName(opts, testName.enc), testName.dec);
      });
    });

    // Test decoding if uriDecodeFileNames: false.
    testData.forEach((testName) => {
      const opts = { uriDecodeFileNames: false };
      it(`Return ${testName.enc} for input ${testName.enc} if uriDecodeFileNames: false`, () => {
        assert.equal(uriDecodeFileName(opts, testName.enc), testName.enc);
      });
    });
  });

  describe('Test for no prototype pollution in buildFields', function() {
    const prototypeFields = [
      { name: '__proto__', data: {} },
      { name: 'constructor', data: {} },
      { name: 'toString', data: {} }
    ];

    const nonPrototypeFields = [
      { name: 'a', data: {} },
      { name: 'b', data: {} }
    ];

    let fieldObject = undefined;
    [...prototypeFields, ...nonPrototypeFields].forEach((field) => {
      fieldObject = buildFields(fieldObject, field.name, field.data);
    });

    it(`Has ${nonPrototypeFields.length} keys`, () => {
      assert.equal(Object.keys(fieldObject).length, nonPrototypeFields.length);
    });

    it(`Has null as its prototype`, () => {
      assert.equal(Object.getPrototypeOf(fieldObject), null);
    });

    prototypeFields.forEach((field) => {
      it(`${field.name} property is not an array`, () => {
        // Note, Array.isArray is an insufficient test due to it returning false
        // for Objects with an array prototype.
        assert.equal(fieldObject[field.name] instanceof Array, false);
      });
    });
  });

  describe('Test for correct detection of prototype pollution', function() {
    const validInsertions = [
      { base: {}, key: 'a' },
      { base: { a: 1 }, key: 'a' },
      { base: { __proto__: { a: 1 } }, key: 'a' },
      { base: [1], key: 0 },
      { base: { __proto__: [1] }, key: 0 }
    ];

    const invalidInsertions = [
      { base: {}, key: '__proto__' },
      { base: {}, key: 'constructor' },
      { base: [1], key: '__proto__' },
      { base: [1], key: 'length' },
      { base: { __proto__: [1] }, key: 'length' }
    ];

    validInsertions.forEach((insertion) => {
      it(`Key ${insertion.key} should be valid for ${JSON.stringify(insertion.base)}`, () => {
        assert.equal(isSafeFromPollution(insertion.base, insertion.key), true);
      });
    });

    invalidInsertions.forEach((insertion) => {
      it(`Key ${insertion.key} should not be valid for ${JSON.stringify(insertion.base)}`, () => {
        assert.equal(isSafeFromPollution(insertion.base, insertion.key), false);
      });
    });
  });
});