HIPCTF2/tests/backend/uploads.spec.ts

process.env.DATABASE_PATH = ':memory:';
process.env.THEMES_DIR = './themes';
process.env.FRONTEND_DIST = './frontend/dist';
process.env.UPLOAD_DIR = '/tmp/hipctf-uploads-test';
process.env.UPLOAD_SIZE_LIMIT = '1mb';

import * as fs from 'fs';
import * as path from 'path';

import { safeFilename, parseUploadSizeLimit } from '../../backend/src/common/utils/upload';

describe('safeFilename', () => {
  it('strips directory traversal', () => {
    expect(safeFilename('../../etc/passwd')).not.toMatch(/\.\./);
    expect(safeFilename('/etc/passwd')).not.toMatch(/^\//);
  });

  it('lowercases and restricts charset to [a-z0-9._-]', () => {
    const out = safeFilename('My File (1).TXT');
    expect(out).toMatch(/^[a-z0-9._-]+$/);
    expect(out).toMatch(/\.txt$/);
  });

  it('always returns a non-empty unique name with a random suffix', () => {
    const a = safeFilename('icon.png');
    const b = safeFilename('icon.png');
    expect(a).not.toBe(b);
    expect(a).toMatch(/^icon-[0-9a-f]{8}\.png$/);
  });

  it('falls back to "file" when nothing usable is left', () => {
    expect(safeFilename('///')).toMatch(/^file-[0-9a-f]{8}$/);
  });
});

describe('parseUploadSizeLimit', () => {
  it('parses kb/mb/gb', () => {
    expect(parseUploadSizeLimit('1kb')).toBe(1024);
    expect(parseUploadSizeLimit('5mb')).toBe(5 * 1024 * 1024);
    expect(parseUploadSizeLimit('2gb')).toBe(2 * 1024 * 1024 * 1024);
    expect(parseUploadSizeLimit('512b')).toBe(512);
  });

  it('defaults to 50mb on invalid input', () => {
    expect(parseUploadSizeLimit(undefined)).toBe(50 * 1024 * 1024);
    expect(parseUploadSizeLimit('garbage')).toBe(50 * 1024 * 1024);
  });
});

// Integration: hit the real endpoint via supertest.
import { Test } from '@nestjs/testing';
import { INestApplication } from '@nestjs/common';
import { HttpAdapterHost } from '@nestjs/core';
import cookieParser from 'cookie-parser';
import * as express from 'express';
import request from 'supertest';
import { CookieAccessInfo } from 'cookiejar';
import { AppModule } from '../../backend/src/app.module';
import { GlobalExceptionFilter } from '../../backend/src/common/filters/global-exception.filter';
import { CsrfMiddleware } from '../../backend/src/common/middleware/csrf.middleware';
import { ConfigService } from '@nestjs/config';
import { initDb } from './db-helper';

describe('Uploads endpoint integration', () => {
  let app: INestApplication;
  let adminToken: string;

  beforeAll(async () => {
    if (fs.existsSync(process.env.UPLOAD_DIR!)) {
      fs.rmSync(process.env.UPLOAD_DIR!, { recursive: true, force: true });
    }
    fs.mkdirSync(process.env.UPLOAD_DIR!, { recursive: true });

    const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
    app = moduleRef.createNestApplication();
    app.use(cookieParser());
    app.use(express.json({ limit: '1mb' }));
    // Mirror production: serve /uploads static so we can verify public fetch.
    app.use('/uploads', express.static(process.env.UPLOAD_DIR!));
    const csrfMw = new CsrfMiddleware(app.get(ConfigService));
    app.use((req: any, res: any, next: any) => csrfMw.use(req, res, next));
    const httpAdapterHost = app.get(HttpAdapterHost);
    app.useGlobalFilters(new GlobalExceptionFilter(httpAdapterHost));
    await app.init();
    await initDb(app);

    const server = app.getHttpServer();
    await request(server).post('/api/v1/auth/register-first-admin')
      .send({ username: 'admin', password: 'Sup3rSecret!Pass' })
      .expect(201);
    const login = await request(server).post('/api/v1/auth/login')
      .send({ username: 'admin', password: 'Sup3rSecret!Pass' })
      .expect(201);
    adminToken = login.body.accessToken;
  });

  afterAll(async () => {
    await app.close();
    if (fs.existsSync(process.env.UPLOAD_DIR!)) {
      fs.rmSync(process.env.UPLOAD_DIR!, { recursive: true, force: true });
    }
  });

  async function primeCsrf(): Promise<{ agent: any; csrf: string }> {
    const server = app.getHttpServer();
    const agent = request.agent(server);
    await agent.get('/api/v1/auth/csrf');
    const cookies: any = agent.jar.getCookies(CookieAccessInfo.All);
    return { agent, csrf: cookies.find((c: any) => c.name === 'csrf').value };
  }

  it('rejects upload without auth (or CSRF)', async () => {
    const res = await request(app.getHttpServer())
      .post('/api/v1/uploads/category-icon')
      .attach('file', Buffer.from('hello'), 'icon.png');
    // Without a session AND without a CSRF cookie, the CSRF middleware
    // short-circuits first with 403. Either 401 (auth) or 403 (csrf) is
    // a valid rejection; the test asserts the upload is rejected.
    expect([401, 403]).toContain(res.status);
  });

  it('uploads a small file successfully', async () => {
    const { agent, csrf } = await primeCsrf();
    const res = await agent
      .post('/api/v1/uploads/category-icon')
      .set('Authorization', `Bearer ${adminToken}`)
      .set('X-CSRF-Token', csrf)
      .attach('file', Buffer.from('hello world'), 'icon.png');
    expect(res.status).toBe(201);
    expect(res.body.id).toMatch(/^icon-[0-9a-f]{8}\.png$/);
    expect(res.body.publicUrl).toBe(`/uploads/icons/${res.body.id}`);
    // File actually written under UPLOAD_DIR/icons
    const written = path.join(process.env.UPLOAD_DIR!, 'icons', res.body.id);
    expect(fs.existsSync(written)).toBe(true);
    // Public-served via /uploads static handler.
    const fetched = await request(app.getHttpServer()).get(res.body.publicUrl).expect(200);
    expect(fetched.body?.toString()).toBe('hello world');
  });

  it('rejects oversize uploads (limit=1mb, file=2mb)', async () => {
    const { agent, csrf } = await primeCsrf();
    const big = Buffer.alloc(2 * 1024 * 1024, 'a'); // 2MB
    const res = await agent
      .post('/api/v1/uploads/category-icon')
      .set('Authorization', `Bearer ${adminToken}`)
      .set('X-CSRF-Token', csrf)
      .attach('file', big, 'big.bin');
    // Multer's LIMIT_FILE_SIZE surfaces as 500 by default; we accept 4xx/5xx
    // and just verify the file was NOT saved.
    expect([400, 413, 500]).toContain(res.status);
    const icons = fs.existsSync(path.join(process.env.UPLOAD_DIR!, 'icons'))
      ? fs.readdirSync(path.join(process.env.UPLOAD_DIR!, 'icons'))
      : [];
    expect(icons.some((f) => f === 'big.bin')).toBe(false);
  });

  it('stores files under per-route subdirectories', async () => {
    const { agent, csrf } = await primeCsrf();
    const res = await agent
      .post('/api/v1/uploads/challenge-file')
      .set('Authorization', `Bearer ${adminToken}`)
      .set('X-CSRF-Token', csrf)
      .attach('file', Buffer.from('attachment'), 'readme.txt');
    expect(res.status).toBe(201);
    expect(res.body.publicUrl).toMatch(/^\/uploads\/challenges\//);
  });
});