est-api/node_modules/express-fileupload/test/tempFile.spec.js

const fs = require('fs');
const md5 = require('md5');
const path = require('path');
const request = require('supertest');
const server = require('./server');
const assert = require('assert');
const process = require('process');

const clearUploadsDir = server.clearUploadsDir;
const fileDir = server.fileDir;
const uploadDir = server.uploadDir;

const tempFileDir = '/tmp/';

/** Default permissions different for win32 and linux systems */
const defaultFilePermissions = process.platform === 'win32' ? 0o666 : 0o644;

describe('tempFile: Test fileupload w/ useTempFiles.', function() {
  afterEach(function(done) {
    clearUploadsDir();
    done();
  });
  /**
   * Upload the file for testing and verify the expected filename.
   * @param {object} options The expressFileUpload options.
   * @param {string} actualFileNameToUpload The name of the file to upload.
   * @param {string} expectedFileNameOnFileSystem The name of the file after upload.
   * @param {function} done The mocha continuation function.
   */
  function executeFileUploadTestWalk(
    options,
    actualFileNameToUpload,
    expectedFileNameOnFileSystem,
    done,
    expectedFilePermissions = defaultFilePermissions
  ) {

    let filePath = path.join(fileDir, actualFileNameToUpload);
    let fileBuffer = fs.readFileSync(filePath);
    let fileHash = md5(fileBuffer);
    let fileStat = fs.statSync(filePath);
    let uploadedFilePath = path.join(uploadDir, expectedFileNameOnFileSystem);

    request(
      server.setup(options)
    )
      .post('/upload/single')
      .attach('testFile', filePath)
      .expect((res)=>{
        res.body.uploadDir = '';
        res.body.uploadPath = '';
      })
      .expect(200, {
        name: expectedFileNameOnFileSystem,
        md5: fileHash,
        size: fileStat.size,
        uploadDir: '',
        uploadPath: ''
      })
      .end(function(err) {
        if (err) {
          return done(err);
        }
        fs.stat(uploadedFilePath, function(err, stats) {
          if (err) {
            return done(err);
          }
          assert.equal(stats.mode & 0o777, expectedFilePermissions);
          done();
        });
      });
  }
  describe('Testing [safeFileNames w/ useTempFiles] option to ensure:', function() {
    it('Does nothing to your filename when disabled.', function(done) {
      const fileUploadOptions = {
        safeFileNames: false,
        useTempFiles: true,
        tempFileDir
      };
      const actualFileName = 'my$Invalid#fileName.png123';
      const expectedFileName = 'my$Invalid#fileName.png123';
      executeFileUploadTestWalk(
        fileUploadOptions,
        actualFileName,
        expectedFileName,
        done
      );
    });
    it('Is disabled by default.', function(done) {
      const fileUploadOptions = {
        useTempFiles: true,
        tempFileDir
      };
      const actualFileName = 'my$Invalid#fileName.png123';
      const expectedFileName = 'my$Invalid#fileName.png123';
      executeFileUploadTestWalk(
        fileUploadOptions,
        actualFileName,
        expectedFileName,
        done
      );
    });

    it(
      'Strips away all non-alphanumeric characters (excluding hyphens/underscores) when enabled.',
      function(done) {
        const fileUploadOptions = {
          safeFileNames: true,
          useTempFiles: true,
          tempFileDir
        };
        const actualFileName = 'my$Invalid#fileName.png123';
        const expectedFileName = 'myInvalidfileNamepng123';
        executeFileUploadTestWalk(
          fileUploadOptions,
          actualFileName,
          expectedFileName,
          done
        );
      });

    it(
      'Accepts a regex for stripping (decidedly) "invalid" characters from filename.',
      function(done) {
        const fileUploadOptions = {
          safeFileNames: /[$#]/g,
          useTempFiles: true,
          tempFileDir
        };
        const actualFileName = 'my$Invalid#fileName.png123';
        const expectedFileName = 'myInvalidfileName.png123';
        executeFileUploadTestWalk(
          fileUploadOptions,
          actualFileName,
          expectedFileName,
          done
        );
      });
  });
  describe('Testing [tempFilePermissions w/ useTempFiles] option to ensure:', function() {
    it('Does nothing to your filename when disabled.', function(done) {
      const fileUploadOptions = {
        safeFileNames: false,
        useTempFiles: true,
        tempFileDir,
        tempFilePermissions: 0o666
      };
      const actualFileName = 'my$Invalid#fileName.png123';
      const expectedFileName = 'my$Invalid#fileName.png123';
      executeFileUploadTestWalk(
        fileUploadOptions,
        actualFileName,
        expectedFileName,
        done
      );
    });
    it('Respects option boundaries when provided.', function(done) {
      const fileUploadOptions = {
        useTempFiles: true,
        tempFileDir,
        tempFilePermissions: 0o7777
      };
      const expressFileupload = require('../lib/index');
      assert.throws(function() {
        expressFileupload(fileUploadOptions);
      }, Error, 'File permissions out of bounds');
      done();
    });
    it('Applies permissions in filesystem.', function(done) {
      const fileUploadOptions = {
        useTempFiles: true,
        tempFileDir,
        tempFilePermissions: 0o600
      };
      const actualFileName = 'my$Invalid#fileName.png123';
      const expectedFileName = 'my$Invalid#fileName.png123';
      // Expected file perms after moving it to the destination folder depends on the platform.
      const expectedFilePermissions = process.platform === 'win32' ? 0o666 : 0o600;

      executeFileUploadTestWalk(
        fileUploadOptions,
        actualFileName,
        expectedFileName,
        done,
        expectedFilePermissions
      );
    });
  });
});