adalal/gotenberg
1
0
Fork 0
mirror of https://github.com/gotenberg/gotenberg.git synced 2026-08-15 11:52:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

refactoring: now detecting file type using filename from form data. Also, only one accepted content type

Browse Source
This commit is contained in:
Julien Neuhart
2018-04-08 21:49:02 +02:00
parent cdeef33ff7
commit bca02f6198
14 changed files with 119 additions and 400 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
app/http/http.go
View File

@@ -4,71 +4,30 @@ package http
import (
"fmt"
"net/http"
"os"
"strings"
)
// ContentType is a string which represents a content type.
type ContentType string
const (
// PDFContentType represents... the PDF content type.
PDFContentType ContentType = "application/pdf"
// HTMLContentType represents... the HTML content type.
HTMLContentType ContentType = "text/html"
// OctetStreamContentType represents... the octet stream content type.
OctetStreamContentType ContentType = "application/octet-stream"
// ZipContentType represents... the zip content type.
ZipContentType ContentType = "application/zip"
// MultipartFormDataContentType represents... the multipart form data content type.
MultipartFormDataContentType ContentType = "multipart/form-data"
)
// MultipartFormDataContentType represents... the multipart form data content type.
const MultipartFormDataContentType ContentType = "multipart/form-data"
type notAuthorizedContentTypeError struct{}
func (e *notAuthorizedContentTypeError) Error() string {
return fmt.Sprintf("Accepted values for 'Content-Type': %s, %s", OctetStreamContentType, MultipartFormDataContentType)
return fmt.Sprintf("Accepted value for 'Content-Type': %s", MultipartFormDataContentType)
}
// FindAuthorizedContentType tries to return a content type according to a request header.
// CheckAuthorizedContentType check if the request header header has an authorized content type.
// If no authorized content type found, throws an error.
func FindAuthorizedContentType(h http.Header) (ContentType, error) {
ct := findContentType(h.Get("Content-Type"), OctetStreamContentType, MultipartFormDataContentType)
func CheckAuthorizedContentType(h http.Header) error {
ct := findContentType(h.Get("Content-Type"), MultipartFormDataContentType)
if ct == "" {
return "", &notAuthorizedContentTypeError{}
return &notAuthorizedContentTypeError{}
}
return ct, nil
}
type notAuthorizedFileContentTypeError struct{}
const notAuthorizedFileContentTypeErrorMessage = "Unable to detect an authorized file content type"
func (e *notAuthorizedFileContentTypeError) Error() string {
return notAuthorizedFileContentTypeErrorMessage
}
// SniffContentType tries to detect the content type of a file.
// If no authorized content type found, throws an error.
func SniffContentType(f *os.File) (ContentType, error) {
// only the first 512 bytes are used to sniff the content type.
buffer := make([]byte, 512)
n, err := f.Read(buffer)
if err != nil {
return "", err
}
// resets the read pointer.
f.Seek(0, 0)
// using n if size of buffer < 512 bytes.
ct := findContentType(http.DetectContentType(buffer[:n]), PDFContentType, HTMLContentType, OctetStreamContentType, ZipContentType)
if ct == "" {
return "", &notAuthorizedFileContentTypeError{}
}
return ct, nil
return nil
}
// findContentType parses a string representing a content type and tries to find

35
app/http/http_test.go
View File

@@ -4,55 +4,28 @@ import (
"fmt"
"net/http"
"net/http/httptest"
"os"
"path/filepath"
"testing"
)
func TestFindAuthorizedContentType(t *testing.T) {
func TestCheckAuthorizedContentType(t *testing.T) {
req := httptest.NewRequest(http.MethodPost, "/", nil)
// case 1: uses a request without a content type entry in its header.
if _, err := FindAuthorizedContentType(req.Header); err == nil {
if err := CheckAuthorizedContentType(req.Header); err == nil {
t.Error("It should not have been able to retrieve an authorized content type from header!")
}
// case 2: uses a request with a content type entry in its header.
req.Header.Set("Content-Type", string(MultipartFormDataContentType))
if _, err := FindAuthorizedContentType(req.Header); err != nil {
if err := CheckAuthorizedContentType(req.Header); err != nil {
t.Error("It should have been able to retrieve an authorized content type from header!")
}
}
func TestSniffContentType(t *testing.T) {
// case 1: uses a file with a wrong content type.
path, _ := filepath.Abs("../../_tests/configurations/gotenberg.yml")
f, _ := os.Open(path)
defer f.Close()
if _, err := SniffContentType(f); err == nil {
t.Error("It should not have been able to retrieve an authorized content type from an YAML file!")
}
// case 2: uses a file with a correct content type.
path, _ = filepath.Abs("../../_tests/file.pdf")
f, _ = os.Open(path)
defer f.Close()
if _, err := SniffContentType(f); err != nil {
t.Error("It should have been able to retrieve an authorized content type from a PDF file!")
}
}
func TestNotAuthorizedContentTypeError(t *testing.T) {
err := &notAuthorizedContentTypeError{}
message := fmt.Sprintf("Accepted values for 'Content-Type': %s, %s", OctetStreamContentType, MultipartFormDataContentType)
message := fmt.Sprintf("Accepted value for 'Content-Type': %s", MultipartFormDataContentType)
if err.Error() != message {
t.Errorf("Error returned a wrong message: got %s want %s", err.Error(), message)
}
}
func TestNotAuthorizedFileContentTypeError(t *testing.T) {
err := &notAuthorizedFileContentTypeError{}
if err.Error() != notAuthorizedFileContentTypeErrorMessage {
t.Errorf("Error returned a wrong message: got %s want %s", err.Error(), notAuthorizedFileContentTypeErrorMessage)
}
}