32dfe6874a
The e2e suite had never been run during this audit. It failed 9 of 256; seven of those predated the audit's changes, established by building a stack from a clean HEAD worktree and running the same specs against it rather than guessing. Most were stale assertions rather than product defects: - quota.spec solved for a target limit using the observed uploader count, but the divisor is max(active, estimated_guest_count, 1) and that config seeds at 100 — so every limit it aimed for came out 100x small and every "within quota" upload 413'd. - rate-limit-shared-nat destructured `ticket` from a 429 body and fetched with `ticket=undefined`, turning the 429 under test into an unrelated 401. It also faked a release with no archive on disk, so the mint's pre-check 404'd and the per-day limiter was never reached; it now does a real release and asserts 200 rather than "not 429". - ddos allowed only [200,429] from ten concurrent streams, so it failed on the very defence it exercises: four tickets per session survive and the rest correctly 401. Now asserts exactly four, which a tightened cap or an inverted eviction order would catch. - auth-tampering asserted a throttled IP is refused EVEN with the correct password. That contract was deliberately removed — it let any phone on the venue NAT lock the operator out of their own admin panel, with a circular escape hatch. Inverted, plus a new check that a success does not refill an attacker's bucket. - moderation-ui assumed a ban leaves a comment "stuck on screen"; `list_for_upload` filters banned authors, so it is hidden from everyone including the host. Now pins the pair that matters — the ban hides it, and the host's permanent removal survives an unban — and the UI leg it used to own is restored as a separate test on a reachable comment. The export specs mint with `?kind=` now that a download ticket is bound to one archive, and four of them assert the mint's 404 rather than the download's: with the kind always known, the pre-check refuses up front instead of after charging a daily download for an archive that cannot be served. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
66 lines
2.8 KiB
TypeScript
66 lines
2.8 KiB
TypeScript
/**
|
|
* Regression for the review's CR2: export archives (Gallery.zip / Memories.zip)
|
|
* were written under media_path/exports, and /media is a public ServeDir — so
|
|
* anyone could GET /media/exports/Gallery.zip and download the whole gallery,
|
|
* bypassing the ticket + export_*_ready gate. Exports now live OUTSIDE media_path
|
|
* and are reachable only via the gated /api/v1/export/{zip,html} handlers.
|
|
*
|
|
* This drives a REAL export (release → job runs → archive on disk) and then
|
|
* asserts the archive is NOT public but IS gated. Asserting a 404 on an empty
|
|
* stack would pass even if exports were still under /media (the file just wouldn't
|
|
* exist yet) — so we produce a real file first, then prove it can't leak.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
import { seedUpload } from '../../helpers/seed';
|
|
import { BASE } from '../../helpers/env';
|
|
|
|
test.describe('Export — no public leak (CR2)', () => {
|
|
test('a real export is downloadable only via the gated endpoint, never via /media', async ({
|
|
host,
|
|
}) => {
|
|
test.setTimeout(60_000);
|
|
const bearer = { Authorization: `Bearer ${host.jwt}` };
|
|
|
|
// Seed content so the archive actually contains a file.
|
|
await seedUpload(host.jwt, { caption: 'in the export' });
|
|
|
|
// Host releases the gallery → spawns the real zip/html export jobs.
|
|
const rel = await fetch(`${BASE}/api/v1/host/gallery/release`, {
|
|
method: 'POST',
|
|
headers: bearer,
|
|
});
|
|
expect(rel.status).toBe(204);
|
|
|
|
// Wait for the real zip job to finish writing the archive to disk.
|
|
await expect
|
|
.poll(
|
|
async () => {
|
|
const res = await fetch(`${BASE}/api/v1/export/status`, { headers: bearer });
|
|
return (await res.json()).zip?.status;
|
|
},
|
|
{ timeout: 45_000, intervals: [500] }
|
|
)
|
|
.toBe('done');
|
|
|
|
// The archive now EXISTS on disk. It must NOT be reachable via public /media…
|
|
for (const name of ['Gallery.zip', 'Memories.zip']) {
|
|
const leak = await fetch(`${BASE}/media/exports/${name}`);
|
|
// A 200 here = the whole-gallery archive is downloadable with no auth (CR2).
|
|
expect(leak.status, `${name} must not be served from public /media`).toBe(404);
|
|
}
|
|
|
|
// …but IS retrievable via the gated single-use ticket endpoint. This proves the
|
|
// 404 above means "not public", not merely "no file was produced".
|
|
const ticketRes = await fetch(`${BASE}/api/v1/export/ticket?kind=zip`, {
|
|
method: 'POST',
|
|
headers: bearer,
|
|
});
|
|
const { ticket } = await ticketRes.json();
|
|
const dl = await fetch(`${BASE}/api/v1/export/zip?ticket=${encodeURIComponent(ticket)}`);
|
|
expect(dl.status).toBe(200);
|
|
// Real ZIP payload: the archive starts with the PK local-file-header magic.
|
|
const head = new Uint8Array(await dl.arrayBuffer()).subarray(0, 2);
|
|
expect(Array.from(head)).toEqual([0x50, 0x4b]); // "PK"
|
|
});
|
|
});
|