← 메인 화면프로젝트 자료·코드
← 자료 목록

cc/tests/test_materials.py

프로그램·코드 · 4.0 KB원본 다운로드

원본 내용을 읽기 전용으로 표시합니다.

  1. import hashlib
  2. import json
  3. from pathlib import Path
  4. import pytest
  5. from startup_app.app import create_app
  6. from tools.publish_materials import publish
  9. @pytest.fixture
  10. def materials_client(tmp_path):
  11. files = tmp_path / 'public' / 'files'
  12. files.mkdir(parents=True)
  13. content = [('example.py', 'code', '<script>alert("x")</script>\nprint("안녕")'),
  14. ('data.csv', 'csv', '이름,값\n<script>,2\n'), ('map.html', 'map', '<html>map</html>'),
  15. ('plot.png', 'image', 'image')]
  16. entries = []
  17. for i, (name, kind, text) in enumerate(content):
  18. (files / name).write_text(text, encoding='utf-8')
  19. entries.append({'id': str(i) * 20, 'path': name, 'kind': kind, 'size': len(text.encode()), 'sha256': 'example', 'rows': 1, 'columns': 2})
  20. (tmp_path / 'outside.txt').write_text('not-public', encoding='utf-8')
  21. entries.append({'id': 'f' * 20, 'path': '../../outside.txt', 'kind': 'text', 'size': 10, 'sha256': 'example'})
  22. (tmp_path / 'public' / 'manifest.json').write_text(json.dumps({'created': 'today', 'files': entries}), encoding='utf-8')
  23. app = create_app()
  24. app.config['MATERIALS_DIR'] = tmp_path / 'public'
  25. return app.test_client()
  28. def test_index_search_and_no_arbitrary_directory(materials_client):
  29. assert 'example.py' in materials_client.get('/materials/').text
  30. filtered = materials_client.get('/materials/?q=example').text
  31. assert 'example.py' in filtered and 'plot.png' not in filtered
  32. assert materials_client.get('/materials/?folder=../../').status_code == 404
  33. assert materials_client.get('/materials/download/.env').status_code == 404
  34. assert materials_client.get('/materials/download/' + 'f' * 20).status_code == 404
  37. def test_source_and_csv_are_escaped(materials_client):
  38. source = materials_client.get('/materials/file/' + '0' * 20)
  39. assert '&lt;script&gt;' in source.text and '<script>alert' not in source.text
  40. data = materials_client.get('/materials/file/' + '1' * 20)
  41. assert '&lt;script&gt;' in data.text and '<script>' not in data.text
  44. def test_download_and_preview_isolation(materials_client):
  45. download = materials_client.get('/materials/download/' + '0' * 20)
  46. assert download.status_code == 200 and 'attachment' in download.headers['Content-Disposition']
  47. frame = materials_client.get('/materials/file/' + '2' * 20)
  48. assert 'sandbox="allow-scripts"' in frame.text
  49. preview = materials_client.get('/materials/preview/' + '2' * 20)
  50. assert preview.status_code == 200 and 'sandbox allow-scripts;' in preview.headers['Content-Security-Policy']
  51. assert 'allow-same-origin' not in preview.headers['Content-Security-Policy']
  52. assert materials_client.get('/materials/preview/' + '0' * 20).status_code == 404
  53. assert materials_client.get('/materials/image/' + '0' * 20).status_code == 404
  54. assert 'frame-src' in frame.headers['Content-Security-Policy']
  57. def test_export_excludes_private_folders_and_stops_on_secret(tmp_path):
  58. root, output = tmp_path / 'project', tmp_path / 'public'
  59. for folder in ('data', 'output', 'cc/startup_app', 'cc/tests', 'cc/tools', 'cc/.venv'):
  60. (root / folder).mkdir(parents=True)
  61. (root / 'app.py').write_text('print("hello")', encoding='utf-8')
  62. (root / 'cc' / '.venv' / 'private.py').write_text('private', encoding='utf-8')
  63. (root / '.env').write_text('private', encoding='utf-8')
  64. for name in ('requirements.txt', 'requirements-dev.txt'):
  65. (root / 'cc' / name).write_text('package', encoding='utf-8')
  66. publish(root, output)
  67. manifest = json.loads((output / 'manifest.json').read_text(encoding='utf-8'))
  68. assert len(manifest['files']) == 3
  69. assert all('.env' not in f['path'] and '.venv' not in f['path'] for f in manifest['files'])
  70. for entry in manifest['files']:
  71. assert hashlib.sha256((output / 'files' / entry['path']).read_bytes()).hexdigest() == entry['sha256']
  72. (root / 'app.py').write_text('token = "' + 'sk-' + 'x' * 40 + '"', encoding='utf-8')
  73. with pytest.raises(ValueError, match='공개 중단'):
  74. publish(root, output)
파일 확인 정보

SHA-256: f815c2432d6cb0b66fdecc1a9d6d7fa17440e643eb3b8612c45af7544f5efc1a