authentik.admin.files.tests.test_validation

  1from django.core.exceptions import ValidationError
  2from django.test import TestCase
  3
  4from authentik.admin.files.validation import (
  5    MAX_FILE_NAME_LENGTH,
  6    MAX_PATH_COMPONENT_LENGTH,
  7    validate_file_name,
  8)
  9
 10
 11class TestSanitizeFilePath(TestCase):
 12    """Test validate_file_name function"""
 13
 14    def test_sanitize_valid_filename(self):
 15        """Test sanitizing valid filename"""
 16        validate_file_name("test.png")
 17
 18    def test_sanitize_valid_path_with_directory(self):
 19        """Test sanitizing valid path with directory"""
 20        validate_file_name("images/test.png")
 21
 22    def test_sanitize_valid_path_with_nested_dirs(self):
 23        """Test sanitizing valid path with nested directories"""
 24        validate_file_name("dir1/dir2/dir3/test.png")
 25
 26    def test_sanitize_with_hyphens(self):
 27        """Test sanitizing filename with hyphens"""
 28        validate_file_name("test-file-name.png")
 29
 30    def test_sanitize_with_underscores(self):
 31        """Test sanitizing filename with underscores"""
 32        validate_file_name("test_file_name.png")
 33
 34    def test_sanitize_with_dots(self):
 35        """Test sanitizing filename with multiple dots"""
 36        validate_file_name("test.file.name.png")
 37
 38    def test_sanitize_strips_whitespace(self):
 39        """Test sanitizing filename strips whitespace"""
 40        with self.assertRaises(ValidationError):
 41            validate_file_name("  test.png  ")
 42
 43    def test_sanitize_removes_duplicate_slashes(self):
 44        """Test sanitizing path removes duplicate slashes"""
 45        with self.assertRaises(ValidationError):
 46            validate_file_name("dir1//dir2///test.png")
 47
 48    def test_sanitize_empty_path_raises(self):
 49        """Test sanitizing empty path raises ValidationError"""
 50        with self.assertRaises(ValidationError):
 51            validate_file_name("")
 52
 53    def test_sanitize_whitespace_only_raises(self):
 54        """Test sanitizing whitespace-only path raises ValidationError"""
 55        with self.assertRaises(ValidationError):
 56            validate_file_name("   ")
 57
 58    def test_sanitize_invalid_characters_raises(self):
 59        """Test sanitizing path with invalid characters raises ValidationError"""
 60        invalid_paths = [
 61            "test file.png",  # space
 62            "test@file.png",  # @
 63            "test#file.png",  # #
 64            "test$file.png",  # $
 65            "test%file.png",  # % (but %(theme)s is allowed)
 66            "test&file.png",  # &
 67            "test*file.png",  # *
 68            "test(file).png",  # parentheses (but %(theme)s is allowed)
 69            "test[file].png",  # brackets
 70            "test{file}.png",  # braces
 71        ]
 72
 73        for path in invalid_paths:
 74            with self.assertRaises(ValidationError):
 75                validate_file_name(path)
 76
 77    def test_sanitize_absolute_path_raises(self):
 78        """Test sanitizing absolute path raises ValidationError"""
 79        with self.assertRaises(ValidationError):
 80            validate_file_name("/absolute/path/test.png")
 81
 82    def test_sanitize_parent_directory_raises(self):
 83        """Test sanitizing path with parent directory reference raises ValidationError"""
 84        with self.assertRaises(ValidationError):
 85            validate_file_name("../test.png")
 86
 87    def test_sanitize_nested_parent_directory_raises(self):
 88        """Test sanitizing path with nested parent directory reference raises ValidationError"""
 89        with self.assertRaises(ValidationError):
 90            validate_file_name("dir1/../test.png")
 91
 92    def test_sanitize_starts_with_dot_raises(self):
 93        """Test sanitizing path starting with dot raises ValidationError"""
 94        with self.assertRaises(ValidationError):
 95            validate_file_name(".hidden")
 96
 97    def test_sanitize_too_long_path_raises(self):
 98        """Test sanitizing too long path raises ValidationError"""
 99        long_path = "a" * (MAX_FILE_NAME_LENGTH + 1) + ".png"
100
101        with self.assertRaises(ValidationError):
102            validate_file_name(long_path)
103
104    def test_sanitize_too_long_component_raises(self):
105        """Test sanitizing path with too long component raises ValidationError"""
106        long_component = "a" * (MAX_PATH_COMPONENT_LENGTH + 1)
107        path = f"dir/{long_component}.png"
108
109        with self.assertRaises(ValidationError):
110            validate_file_name(path)
111
112    def test_sanitize_theme_variable_valid(self):
113        """Test sanitizing filename with %(theme)s variable"""
114        # These should all be valid
115        validate_file_name("logo-%(theme)s.png")
116        validate_file_name("brand/logo-%(theme)s.svg")
117        validate_file_name("images/icon-%(theme)s.png")
118        validate_file_name("%(theme)s/logo.png")
119        validate_file_name("brand/%(theme)s/logo.png")
120
121    def test_sanitize_theme_variable_multiple(self):
122        """Test sanitizing filename with multiple %(theme)s variables"""
123        validate_file_name("%(theme)s/logo-%(theme)s.png")
124
125    def test_sanitize_theme_variable_invalid_format(self):
126        """Test that partial or malformed theme variables are rejected"""
127        invalid_paths = [
128            "test%(theme.png",  # missing )s
129            "test%theme)s.png",  # missing (
130            "test%(themes).png",  # wrong variable name
131            "test%(THEME)s.png",  # wrong case
132            "test%()s.png",  # empty variable name
133        ]
134
135        for path in invalid_paths:
136            with self.assertRaises(ValidationError):
137                validate_file_name(path)