@@ -597,18 +597,17 @@ describe("loadWebMedia", () => {
597597}
598598});
599599600-it("rejects host-read text files outside local roots", async () => {
601-const secretFile = path.join(fixtureRoot, "secret.txt");
602-await fs.writeFile(secretFile, "secret", "utf8");
603-await expectLoadWebMediaErrorCode(
604-loadWebMedia(secretFile, {
605-maxBytes: 1024 * 1024,
606-localRoots: "any",
607-readFile: async (filePath) => await fs.readFile(filePath),
608-hostReadCapability: true,
609-}),
610-"path-not-allowed",
611-);
600+it("allows validated host-read TXT files", async () => {
601+const txtFile = path.join(fixtureRoot, "notes.txt");
602+await fs.writeFile(txtFile, "plain text\n", "utf8");
603+const result = await loadWebMedia(txtFile, {
604+maxBytes: 1024 * 1024,
605+localRoots: "any",
606+readFile: async (filePath) => await fs.readFile(filePath),
607+hostReadCapability: true,
608+});
609+expect(result.kind).toBe("document");
610+expect(result.contentType).toBe("text/plain");
612611});
613612614613it("rejects renamed host-read text files even when the extension looks allowed", async () => {
@@ -771,40 +770,51 @@ describe("loadWebMedia", () => {
771770{
772771label: "ZIP",
773772fileName: "archive.zip",
773+body: Buffer.from([0x50, 0x4b, 0x03, 0x04]),
774774contentType: "application/zip",
775-buffer: Buffer.from([0x50, 0x4b, 0x03, 0x04]),
776775},
777776{
778777label: "gzip",
779778fileName: "archive.gz",
779+body: Buffer.from([0x1f, 0x8b, 0x08, 0x00, 0, 0, 0, 0, 0, 0x03]),
780780contentType: "application/gzip",
781-buffer: Buffer.from([0x1f, 0x8b, 0x08, 0x00, 0, 0, 0, 0, 0, 0x03]),
782781},
783782{
784783label: "tar",
785784fileName: "archive.tar",
786-contentType: "application/x-tar",
787-buffer: (() => {
785+body: (() => {
788786const buffer = Buffer.alloc(512);
789787buffer.write("ustar", 257, "ascii");
790788return buffer;
791789})(),
790+contentType: "application/x-tar",
792791},
793792{
794793label: "7z",
795794fileName: "archive.7z",
795+body: Buffer.from([0x37, 0x7a, 0xbc, 0xaf, 0x27, 0x1c, 0, 4]),
796796contentType: "application/x-7z-compressed",
797-buffer: Buffer.from([0x37, 0x7a, 0xbc, 0xaf, 0x27, 0x1c, 0, 4]),
798797},
799-])("allows host-read $label files", async ({ fileName, contentType, buffer }) => {
800-const archiveFile = path.join(fixtureRoot, fileName);
801-await fs.writeFile(archiveFile, buffer);
802-const result = await loadWebMedia(archiveFile, {
803-maxBytes: 1024 * 1024,
804-localRoots: "any",
805-readFile: async (filePath) => await fs.readFile(filePath),
806-hostReadCapability: true,
807-});
798+{
799+label: "JSON",
800+fileName: "data.json",
801+body: '{"ok":true}\n',
802+contentType: "application/json",
803+},
804+{
805+label: "YAML",
806+fileName: "config.yaml",
807+body: "ok: true\n",
808+contentType: "application/yaml",
809+},
810+{
811+label: "YML",
812+fileName: "config.yml",
813+body: "ok: true\n",
814+contentType: "application/yaml",
815+},
816+])("allows host-read $label files", async ({ fileName, body, contentType }) => {
817+const result = await loadDocumentWithHostRead(fileName, body);
808818expect(result.kind).toBe("document");
809819expect(result.contentType).toBe(contentType);
810820});
@@ -829,7 +839,11 @@ describe("loadWebMedia", () => {
829839{ label: "CSV", fileName: "opaque.csv" },
830840{ label: "HTML", fileName: "opaque.html" },
831841{ label: "Markdown", fileName: "opaque.md" },
832-])("rejects opaque non-NUL binary data disguised as %s", async ({ fileName }) => {
842+{ label: "TXT", fileName: "opaque.txt" },
843+{ label: "JSON", fileName: "opaque.json" },
844+{ label: "YAML", fileName: "opaque.yaml" },
845+{ label: "YML", fileName: "opaque.yml" },
846+])("rejects opaque non-NUL binary data disguised as $label", async ({ fileName }) => {
833847const fakeTextFile = path.join(fixtureRoot, fileName);
834848const opaqueBinary = Buffer.alloc(9000);
835849for (let i = 0; i < opaqueBinary.length; i += 1) {
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。