Close data leaks: remove anonymous user creation, hide private playlists, validate uploads and clamp gateway ranges

2026-09-24 05:00:21 +02:00
parent c8fe28b07b
commit c8e9c7790e
34 changed files with 374 additions and 553 deletions
@@ -1,51 +0,0 @@
-using Musify.Api.DataTransferObjects.Users;
-using Musify.Api.Validators.Users;
-using Xunit;
-
-namespace Musify.Api.Tests.Validators;
-
-public sealed class CreateUserRequestValidatorTests
-{
-    private readonly CreateUserRequestValidator validator = new();
-
-    [Fact]
-    public void Validate_ValidRequest_Passes()
-    {
-        var result = validator.Validate(new CreateUserRequest(1, "Jane Doe", "Jane", "Doe"));
-
-        Assert.True(result.IsValid);
-    }
-
-    [Fact]
-    public void Validate_ZeroId_Fails()
-    {
-        var result = validator.Validate(new CreateUserRequest(0, "Jane Doe", null, null));
-
-        Assert.False(result.IsValid);
-        Assert.Contains(result.Errors, e => e.PropertyName == nameof(CreateUserRequest.Id));
-    }
-
-    [Fact]
-    public void Validate_BlankName_Fails()
-    {
-        var result = validator.Validate(new CreateUserRequest(1, "", null, null));
-
-        Assert.False(result.IsValid);
-    }
-
-    [Fact]
-    public void Validate_NameOverMaxLength_Fails()
-    {
-        var result = validator.Validate(new CreateUserRequest(1, new string('a', 49), null, null));
-
-        Assert.False(result.IsValid);
-    }
-
-    [Fact]
-    public void Validate_OptionalNamesOmitted_Passes()
-    {
-        var result = validator.Validate(new CreateUserRequest(1, "Jane Doe", null, null));
-
-        Assert.True(result.IsValid);
-    }
-}
@@ -0,0 +1,49 @@
+using Musify.Api.DataTransferObjects.Albums;
+using Musify.Api.DataTransferObjects.Tracks;
+using Musify.Api.Validators.Albums;
+using Musify.Api.Validators.Tracks;
+using Musify.Application.Configuration;
+using Xunit;
+
+namespace Musify.Api.Tests.Validators;
+
+public sealed class UploadRequestValidatorTests
+{
+    private readonly UploadIntentConfiguration configuration = new() { MaxUploadBytes = 1_000 };
+
+    [Fact]
+    public void PictureUpload_ValidRequest_Passes()
+    {
+        var validator = new RequestAlbumPictureUploadRequestValidator(configuration);
+
+        var result = validator.Validate(new RequestAlbumPictureUploadRequest("webp", "image/webp", 500));
+
+        Assert.True(result.IsValid);
+    }
+
+    [Theory]
+    [InlineData("exe", "image/webp", 500L)]
+    [InlineData("averyveryveryloongextension", "image/webp", 500L)]
+    [InlineData("we bp", "image/webp", 500L)]
+    [InlineData("webp", "text/html", 500L)]
+    [InlineData("webp", "image/webp", 0L)]
+    [InlineData("webp", "image/webp", 1_001L)]
+    public void PictureUpload_InvalidRequest_Fails(string fileType, string contentType, long size)
+    {
+        var validator = new RequestAlbumPictureUploadRequestValidator(configuration);
+
+        var result = validator.Validate(new RequestAlbumPictureUploadRequest(fileType, contentType, size));
+
+        Assert.False(result.IsValid);
+    }
+
+    [Fact]
+    public void TrackUpload_AudioTypesAreCheckedAgainstTheAudioAllowList()
+    {
+        var validator = new RequestTrackUploadUrlsRequestValidator(configuration);
+
+        Assert.True(validator.Validate(new RequestTrackUploadUrlsRequest("png", "image/png", "mp3", "audio/mpeg", 10, 900)).IsValid);
+        Assert.False(validator.Validate(new RequestTrackUploadUrlsRequest("png", "image/png", "png", "image/png")).IsValid);
+        Assert.False(validator.Validate(new RequestTrackUploadUrlsRequest("mp3", "audio/mpeg", "mp3", "audio/mpeg")).IsValid);
+    }
+}