78 lines
2.8 KiB
Python
78 lines
2.8 KiB
Python
"""Local UI dependencies are served without exposing project data."""
|
|
import http.client
|
|
import threading
|
|
from http.server import ThreadingHTTPServer
|
|
|
|
import pytest
|
|
|
|
from omni import serve
|
|
|
|
|
|
@pytest.fixture
|
|
def static_server(tmp_path, monkeypatch):
|
|
web = tmp_path / "web"
|
|
vendor = web / "vendor" / "tabler"
|
|
vendor.mkdir(parents=True)
|
|
(vendor / "tabler.min.css").write_text("body{color:#123}", encoding="utf-8")
|
|
(vendor / "tabler.min.js").write_text("window.tabler={};", encoding="utf-8")
|
|
(web / "index.html").write_text("<html>panel</html>", encoding="utf-8")
|
|
(web / "private.js").write_text("private", encoding="utf-8")
|
|
(vendor / "secret.json").write_text('{"secret":"test-only"}', encoding="utf-8")
|
|
(tmp_path / "outside.js").write_text("outside", encoding="utf-8")
|
|
monkeypatch.setattr(serve, "WEB", web)
|
|
server = ThreadingHTTPServer(("127.0.0.1", 0), serve.Handler)
|
|
thread = threading.Thread(target=server.serve_forever, daemon=True)
|
|
thread.start()
|
|
|
|
def get(path):
|
|
connection = http.client.HTTPConnection("127.0.0.1", server.server_port, timeout=5)
|
|
try:
|
|
connection.request("GET", path)
|
|
response = connection.getresponse()
|
|
return response.status, dict(response.getheaders()), response.read()
|
|
finally:
|
|
connection.close()
|
|
|
|
try:
|
|
yield get
|
|
finally:
|
|
server.shutdown()
|
|
server.server_close()
|
|
thread.join(timeout=5)
|
|
|
|
|
|
@pytest.mark.parametrize("name,ctype,expected", [
|
|
("tabler.min.css", "text/css; charset=utf-8", b"body{color:#123}"),
|
|
("tabler.min.js", "text/javascript; charset=utf-8", b"window.tabler={};"),
|
|
])
|
|
def test_local_template_assets(static_server, name, ctype, expected):
|
|
status, headers, body = static_server("/assets/vendor/tabler/" + name + "?v=1.7.1")
|
|
assert status == 200 and body == expected
|
|
assert headers["Content-Type"] == ctype
|
|
assert headers["X-Content-Type-Options"] == "nosniff"
|
|
assert int(headers["Content-Length"]) == len(expected)
|
|
|
|
|
|
@pytest.mark.parametrize("path", [
|
|
"/assets/vendor/tabler/missing.js",
|
|
"/assets/vendor/tabler/",
|
|
"/assets/vendor/tabler/secret.json",
|
|
"/assets/private.js",
|
|
"/assets/index.html",
|
|
"/assets/vendor/../../private.js",
|
|
"/assets/vendor/%2e%2e/%2e%2e/outside.js",
|
|
"/assets/%2foutside.js",
|
|
"/assets/vendor/..%5c..%5cprivate.js",
|
|
"/assets/vendor/%00.js",
|
|
])
|
|
def test_assets_reject_private_files_and_traversal(static_server, path):
|
|
status, _, body = static_server(path)
|
|
assert status == 404
|
|
assert body == b"not found"
|
|
|
|
|
|
def test_index_still_served(static_server):
|
|
status, headers, body = static_server("/")
|
|
assert status == 200 and body == b"<html>panel</html>"
|
|
assert headers["Content-Type"].startswith("text/html")
|