NotS1mp/Musify
0
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects Releases Wiki Activity

Close data leaks: remove anonymous user creation, hide private playlists, validate uploads and clamp gateway ranges

Browse Source
This commit is contained in:
Admin
2026-09-24 05:00:21 +02:00
parent c8fe28b07b
commit c8e9c7790e
34 changed files with 374 additions and 553 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/Tests/Musify.Api.Tests/Endpoints/AlbumEndpointsTests.cs
+1 -9
View File
@@ -1,7 +1,6 @@
using System.Net;
using System.Net.Http.Json;
using Musify.Api.DataTransferObjects.Albums;
using Musify.Api.DataTransferObjects.Users;
using Musify.Api.Tests.TestSupport;
using Musify.Application.Albums.Responses;
using Musify.Application.Contracts;
@@ -13,14 +12,7 @@ namespace Musify.Api.Tests.Endpoints;
[Collection(ApiCollection.Name)]
public sealed class AlbumEndpointsTests(ApiTestFixture fixture)
{
private async Task<long> CreateUserAsync()
{
var userId = Random.Shared.NextInt64(1, long.MaxValue);
var response = await fixture.CreateAnonymousClient()
.PostAsJsonAsync("/users", new CreateUserRequest(userId, $"user-{userId}", null, null));
response.EnsureSuccessStatusCode();
return userId;
}
private Task<long> CreateUserAsync() => fixture.SeedUserAsync();
private async Task<Guid> CreatePictureIntentAsync(HttpClient client)
{
backend/Tests/Musify.Api.Tests/Endpoints/ListeningProgressEndpointsTests.cs
+1 -9
View File
@@ -3,7 +3,6 @@ using System.Net.Http.Json;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.DependencyInjection;
using Musify.Api.DataTransferObjects.Tracks;
using Musify.Api.DataTransferObjects.Users;
using Musify.Api.Tests.TestSupport;
using Musify.Domain.Entities;
using Musify.Infrastructure.Persistence;
@@ -14,14 +13,7 @@ namespace Musify.Api.Tests.Endpoints;
[Collection(ApiCollection.Name)]
public sealed class ListeningProgressEndpointsTests(ApiTestFixture fixture)
{
private async Task<long> CreateUserAsync()
{
var userId = Random.Shared.NextInt64(1, long.MaxValue);
var response = await fixture.CreateAnonymousClient().PostAsJsonAsync(
"/users", new CreateUserRequest(userId, $"user-{userId}", null, null), TestContext.Current.CancellationToken);
response.EnsureSuccessStatusCode();
return userId;
}
private Task<long> CreateUserAsync() => fixture.SeedUserAsync();
private async Task<Guid> SeedListenAsync(long userId, double durationSeconds)
{
backend/Tests/Musify.Api.Tests/Endpoints/UserEndpointsTests.cs
+6 -34
View File
@@ -4,7 +4,6 @@ using System.Text.Json;
using System.Text.Json.Serialization;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.DependencyInjection;
using Musify.Api.DataTransferObjects.Users;
using Musify.Api.Tests.TestSupport;
using Musify.Application.Tracks.Responses;
using Musify.Application.Users.Responses;
@@ -45,40 +44,13 @@ public sealed class UserEndpointsTests(ApiTestFixture fixture)
}
[Fact]
public async Task PostUsers_NewUser_ReturnsCreatedWithLocationHeader()
{
var client = fixture.CreateAnonymousClient();
var userId = Random.Shared.NextInt64(1, long.MaxValue);
var response = await client.PostAsJsonAsync("/users", new CreateUserRequest(userId, "Jane Doe", "Jane", "Doe"), TestContext.Current.CancellationToken);
Assert.Equal(HttpStatusCode.Created, response.StatusCode);
Assert.Equal($"/users/{userId}", response.Headers.Location?.OriginalString);
var body = await response.Content.ReadFromJsonAsync<UserApplicationResponse>(TestContext.Current.CancellationToken);
Assert.NotNull(body);
Assert.Equal("Jane Doe", body.Name);
}
[Fact]
public async Task PostUsers_BlankName_ReturnsValidationProblem()
public async Task PostUsers_IsNotExposed()
{
var client = fixture.CreateAnonymousClient();
var response = await client.PostAsJsonAsync("/users", new CreateUserRequest(Random.Shared.NextInt64(1, long.MaxValue), "", null, null), TestContext.Current.CancellationToken);
var response = await client.PostAsJsonAsync("/users", new { id = 1, name = "Intruder" }, TestContext.Current.CancellationToken);
Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
}
[Fact]
public async Task PostUsers_DuplicateId_ReturnsConflict()
{
var client = fixture.CreateAnonymousClient();
var userId = Random.Shared.NextInt64(1, long.MaxValue);
await client.PostAsJsonAsync("/users", new CreateUserRequest(userId, "First", null, null), TestContext.Current.CancellationToken);
var response = await client.PostAsJsonAsync("/users", new CreateUserRequest(userId, "Second", null, null), TestContext.Current.CancellationToken);
Assert.Equal(HttpStatusCode.Conflict, response.StatusCode);
Assert.True(response.StatusCode is HttpStatusCode.NotFound or HttpStatusCode.MethodNotAllowed);
}
[Fact]
@@ -86,7 +58,7 @@ public sealed class UserEndpointsTests(ApiTestFixture fixture)
{
var client = fixture.CreateAnonymousClient();
var userId = Random.Shared.NextInt64(1, long.MaxValue);
await client.PostAsJsonAsync("/users", new CreateUserRequest(userId, "Findable User", null, null), TestContext.Current.CancellationToken);
await fixture.SeedUserAsync(userId, "Findable User");
var response = await client.GetAsync($"/users/{userId}", TestContext.Current.CancellationToken);
@@ -110,7 +82,7 @@ public sealed class UserEndpointsTests(ApiTestFixture fixture)
{
var client = fixture.CreateAnonymousClient();
var userId = Random.Shared.NextInt64(1, long.MaxValue);
await client.PostAsJsonAsync("/users", new CreateUserRequest(userId, $"user-{userId}", null, null), TestContext.Current.CancellationToken);
await fixture.SeedUserAsync(userId);
await SeedListenAsync(userId, "Older listen", DateTime.UtcNow.AddMinutes(-10));
await SeedListenAsync(userId, "Newer listen", DateTime.UtcNow);
@@ -126,7 +98,7 @@ public sealed class UserEndpointsTests(ApiTestFixture fixture)
{
var client = fixture.CreateAnonymousClient();
var userId = Random.Shared.NextInt64(1, long.MaxValue);
await client.PostAsJsonAsync("/users", new CreateUserRequest(userId, $"user-{userId}", null, null), TestContext.Current.CancellationToken);
await fixture.SeedUserAsync(userId);
var response = await client.GetAsync($"/users/{userId}/last-listened-track", TestContext.Current.CancellationToken);
backend/Tests/Musify.Api.Tests/TestSupport/ApiTestFixture.cs
+17
View File
@@ -44,6 +44,23 @@ public sealed class ApiTestFixture : WebApplicationFactory<Program>, IAsyncLifet
public HttpClient CreateAnonymousClient() => CreateClient();
public async Task<long> SeedUserAsync(long? userId = null, string? name = null)
{
var id = userId ?? Random.Shared.NextInt64(1, long.MaxValue);
var userName = name ?? $"user-{id}";
using var scope = Services.CreateScope();
var database = scope.ServiceProvider.GetRequiredService<Musify.Infrastructure.Persistence.Database>();
database.Users.Add(new Musify.Domain.Entities.User
{
Id = id,
Name = userName,
NormalizedName = userName.ToUpperInvariant()
});
await database.SaveChangesAsync();
return id;
}
public HttpClient CreateAuthenticatedClient(long userId, string userName = "test-user")
{
var client = CreateClient();
backend/Tests/Musify.Api.Tests/Validators/CreateUserRequestValidatorTests.cs
-51
View File
@@ -1,51 +0,0 @@
using Musify.Api.DataTransferObjects.Users;
using Musify.Api.Validators.Users;
using Xunit;
namespace Musify.Api.Tests.Validators;
public sealed class CreateUserRequestValidatorTests
{
private readonly CreateUserRequestValidator validator = new();
[Fact]
public void Validate_ValidRequest_Passes()
{
var result = validator.Validate(new CreateUserRequest(1, "Jane Doe", "Jane", "Doe"));
Assert.True(result.IsValid);
}
[Fact]
public void Validate_ZeroId_Fails()
{
var result = validator.Validate(new CreateUserRequest(0, "Jane Doe", null, null));
Assert.False(result.IsValid);
Assert.Contains(result.Errors, e => e.PropertyName == nameof(CreateUserRequest.Id));
}
[Fact]
public void Validate_BlankName_Fails()
{
var result = validator.Validate(new CreateUserRequest(1, "", null, null));
Assert.False(result.IsValid);
}
[Fact]
public void Validate_NameOverMaxLength_Fails()
{
var result = validator.Validate(new CreateUserRequest(1, new string('a', 49), null, null));
Assert.False(result.IsValid);
}
[Fact]
public void Validate_OptionalNamesOmitted_Passes()
{
var result = validator.Validate(new CreateUserRequest(1, "Jane Doe", null, null));
Assert.True(result.IsValid);
}
}
backend/Tests/Musify.Api.Tests/Validators/UploadRequestValidatorTests.cs
+49
View File
@@ -0,0 +1,49 @@
using Musify.Api.DataTransferObjects.Albums;
using Musify.Api.DataTransferObjects.Tracks;
using Musify.Api.Validators.Albums;
using Musify.Api.Validators.Tracks;
using Musify.Application.Configuration;
using Xunit;
namespace Musify.Api.Tests.Validators;
public sealed class UploadRequestValidatorTests
{
private readonly UploadIntentConfiguration configuration = new() { MaxUploadBytes = 1_000 };
[Fact]
public void PictureUpload_ValidRequest_Passes()
{
var validator = new RequestAlbumPictureUploadRequestValidator(configuration);
var result = validator.Validate(new RequestAlbumPictureUploadRequest("webp", "image/webp", 500));
Assert.True(result.IsValid);
}
[Theory]
[InlineData("exe", "image/webp", 500L)]
[InlineData("averyveryveryloongextension", "image/webp", 500L)]
[InlineData("we bp", "image/webp", 500L)]
[InlineData("webp", "text/html", 500L)]
[InlineData("webp", "image/webp", 0L)]
[InlineData("webp", "image/webp", 1_001L)]
public void PictureUpload_InvalidRequest_Fails(string fileType, string contentType, long size)
{
var validator = new RequestAlbumPictureUploadRequestValidator(configuration);
var result = validator.Validate(new RequestAlbumPictureUploadRequest(fileType, contentType, size));
Assert.False(result.IsValid);
}
[Fact]
public void TrackUpload_AudioTypesAreCheckedAgainstTheAudioAllowList()
{
var validator = new RequestTrackUploadUrlsRequestValidator(configuration);
Assert.True(validator.Validate(new RequestTrackUploadUrlsRequest("png", "image/png", "mp3", "audio/mpeg", 10, 900)).IsValid);
Assert.False(validator.Validate(new RequestTrackUploadUrlsRequest("png", "image/png", "png", "image/png")).IsValid);
Assert.False(validator.Validate(new RequestTrackUploadUrlsRequest("mp3", "audio/mpeg", "mp3", "audio/mpeg")).IsValid);
}
}