@@ -568,6 +568,45 @@ describe("resolveMedia getFile retry", () => {
568568});
569569});
570570571+it("copies trusted local file paths whose names start with dots", async () => {
572+const getFile = vi
573+.fn()
574+.mockResolvedValue({ file_path: "/var/lib/telegram-bot-api/..photo.jpg" });
575+rootRead.mockResolvedValueOnce({
576+buffer: Buffer.from("image-data"),
577+realPath: "/var/lib/telegram-bot-api/..photo.jpg",
578+stat: { size: 10 },
579+});
580+saveMediaBuffer.mockResolvedValueOnce({
581+path: "/tmp/inbound/photo.jpg",
582+contentType: "image/jpeg",
583+});
584+585+const result = await resolveMediaWithDefaults(
586+makeCtx("document", getFile, { file_name: "..photo.jpg", mime_type: "image/jpeg" }),
587+{ trustedLocalFileRoots: ["/var/lib/telegram-bot-api"] },
588+);
589+590+expect(readRemoteMediaBuffer).not.toHaveBeenCalled();
591+expect(rootRead).toHaveBeenCalledWith({
592+rootDir: "/var/lib/telegram-bot-api",
593+relativePath: "..photo.jpg",
594+maxBytes: MAX_MEDIA_BYTES,
595+});
596+expect(saveMediaBuffer).toHaveBeenCalledWith(
597+Buffer.from("image-data"),
598+"image/jpeg",
599+"inbound",
600+MAX_MEDIA_BYTES,
601+"..photo.jpg",
602+);
603+expectResolvedMediaFields(result, "trusted local dot-prefixed document", {
604+path: "/tmp/inbound/photo.jpg",
605+contentType: "image/jpeg",
606+placeholder: "<media:document>",
607+});
608+});
609+571610it("copies trusted local absolute file paths into inbound media storage for sticker downloads", async () => {
572611const getFile = vi
573612.fn()
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。