Files
Downloader/server/test/sessions.test.ts
evandro dee0771ac5 fix(server): bloqueia SSRF e path traversal na sessão e segue redirects
- SSRF: /api/queue aceitava qualquer URL, inclusive localhost, rede
  privada e 169.254.169.254. Agora só http/https e, por padrão, nada de
  endereço local/privado (checagem na fila e no conector do undici, que
  cobre DNS rebinding e redirects). ALLOW_PRIVATE_NETWORK=true libera.
- O header x-session-id virava nome de diretório sem validação; com ".."
  a expiração faria rmSync em server/. Agora só UUID é aceito.
- Respostas 3xx eram salvas como se fossem o arquivo; agora segue até 5
  redirects e trata 3xx restante como erro.
- decodeURIComponent inválido no Content-Disposition derrubava o download.
- web: useCallback em refreshTasks (corrige o warning exhaustive-deps).
2026-10-10 03:59:44 -03:00

107 lines
4.2 KiB
TypeScript

import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import { createServer, type Server } from "node:http";
import type { AddressInfo } from "node:net";
import { existsSync, readdirSync, rmSync } from "node:fs";
import { sep } from "node:path";
import { Agent } from "undici";
import { loadModules } from "./helpers.js";
const HOUR = 60 * 60 * 1000;
let origin: Server;
let originUrl: string;
beforeEach(async () => {
process.env.ALLOW_PRIVATE_NETWORK = "true"; // a origem de teste está em 127.0.0.1
vi.useFakeTimers({ toFake: ["setInterval", "Date"] });
origin = createServer((_req, res) => {
res.setHeader("content-length", "5");
res.end("hello");
});
await new Promise<void>((done) => origin.listen(0, "127.0.0.1", done));
originUrl = `http://127.0.0.1:${(origin.address() as AddressInfo).port}/file.txt`;
});
afterEach(async () => {
delete process.env.ALLOW_PRIVATE_NETWORK;
vi.useRealTimers();
await new Promise((done) => origin.close(done));
});
async function waitForStatus(
read: () => string | undefined,
wanted: string,
) {
for (let i = 0; i < 500 && read() !== wanted; i++) {
await new Promise((done) => setImmediate(done));
}
expect(read()).toBe(wanted);
}
describe("tasks e sessões", () => {
it("descarta as tasks e os arquivos quando a sessão expira", async () => {
const { sessionManager, DownloadManager, storageRoot } = await loadModules();
const manager = new DownloadManager(new Agent());
const session = sessionManager.getSession();
const task = await manager.queueDownload(session.id, originUrl);
await waitForStatus(() => manager.getTask(task.id)?.status, "completed");
expect(readdirSync(`${storageRoot}/${session.id}`)).toHaveLength(1);
vi.setSystemTime(Date.now() + HOUR + 1000);
vi.advanceTimersByTime(60_000); // dispara o coletor
expect(manager.getTask(task.id)).toBeUndefined();
expect(manager.getTasks(session.id)).toEqual([]);
expect(existsSync(`${storageRoot}/${session.id}`)).toBe(false);
rmSync(storageRoot, { recursive: true, force: true });
});
it("mantém as tasks de outras sessões ainda ativas", async () => {
const { sessionManager, DownloadManager, storageRoot } = await loadModules();
const manager = new DownloadManager(new Agent());
const expiring = sessionManager.getSession();
await manager.queueDownload(expiring.id, originUrl);
vi.setSystemTime(Date.now() + HOUR - 1000);
const alive = sessionManager.getSession(); // criada perto do fim da outra
const kept = await manager.queueDownload(alive.id, originUrl);
vi.setSystemTime(Date.now() + 2000);
vi.advanceTimersByTime(60_000);
expect(manager.getTasks(expiring.id)).toEqual([]);
expect(manager.getTask(kept.id)).toBeDefined();
rmSync(storageRoot, { recursive: true, force: true });
});
});
describe("id de sessão", () => {
it("aceita um UUID já conhecido", async () => {
const { sessionManager, storageRoot } = await loadModules();
const first = sessionManager.getSession();
expect(sessionManager.getSession(first.id).id).toBe(first.id);
rmSync(storageRoot, { recursive: true, force: true });
});
it.each(["..", ".", "../../etc", "a/b", "not-a-uuid", ""])(
"ignora o id inválido %j e cria outra sessão",
async (bad) => {
const { sessionManager, storageRoot } = await loadModules();
const session = sessionManager.getSession(bad);
expect(session.id).toMatch(/^[0-9a-f-]{36}$/);
expect(sessionManager.getSessionPath(session.id)).toBe(`${storageRoot}${sep}${session.id}`);
rmSync(storageRoot, { recursive: true, force: true });
},
);
it("não deixa um id '..' apagar a pasta pai quando expira", async () => {
const { sessionManager, storageRoot } = await loadModules();
sessionManager.getSession("..");
vi.setSystemTime(Date.now() + HOUR + 1000);
vi.advanceTimersByTime(60_000);
expect(existsSync(storageRoot)).toBe(true);
rmSync(storageRoot, { recursive: true, force: true });
});
});