mirror of
https://github.com/openfoodfoundation/openfoodnetwork
synced 2026-01-24 20:36:49 +00:00
extract file path sanitizer to an independent class
This commit is contained in:
committed by
Maikel Linke
parent
4d5ba6a7e6
commit
fcb8550cb1
@@ -118,9 +118,7 @@ module Admin
|
||||
end
|
||||
|
||||
def sanitize_file_path(file_path)
|
||||
pathname = Pathname.new(file_path)
|
||||
raise_invalid_file_path unless pathname.file?
|
||||
pathname.realpath
|
||||
FilePathSanitizer.new.sanitize(file_path, on_error: method(:raise_invalid_file_path))
|
||||
end
|
||||
|
||||
def validate_file_path(file_path)
|
||||
|
||||
11
app/services/file_path_sanitizer.rb
Normal file
11
app/services/file_path_sanitizer.rb
Normal file
@@ -0,0 +1,11 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
class FilePathSanitizer
|
||||
def sanitize(file_path, on_error: nil)
|
||||
pathname = Pathname.new(file_path)
|
||||
return pathname.realpath if pathname.file?
|
||||
|
||||
on_error&.call
|
||||
false
|
||||
end
|
||||
end
|
||||
@@ -45,38 +45,4 @@ describe Admin::ProductImportController, type: :controller do
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
describe 'sanitize_file_path' do
|
||||
let(:folder_path){ '/tmp/product_import123' }
|
||||
let(:file_path) { "#{folder_path}/import.csv" }
|
||||
|
||||
before do
|
||||
FileUtils.mkdir_p(folder_path)
|
||||
File.new(file_path, 'w') unless File.exist?(file_path)
|
||||
end
|
||||
|
||||
def subject(path)
|
||||
# expose the private method sanitize_file_path
|
||||
described_class.class_eval { public :sanitize_file_path }
|
||||
described_class.new.__send__(:sanitize_file_path, path)
|
||||
end
|
||||
|
||||
it 'should covert relative path to absolute' do
|
||||
path = "/tmp/product_import123/import.csv"
|
||||
expect(subject(path).to_s).to eq file_path
|
||||
|
||||
path1 = "/../../tmp/product_import123/import.csv"
|
||||
expect(subject(path1).to_s).to eq file_path
|
||||
|
||||
path2 = "/etc/../../../tmp/product_import123/import.csv"
|
||||
expect(subject(path2).to_s).to eq file_path
|
||||
end
|
||||
|
||||
it "raise an exception if the file doesn't exist" do
|
||||
path = '/tmp/product_import123/import1.csv'
|
||||
allow_any_instance_of(described_class).to receive(:raise_invalid_file_path)
|
||||
.and_raise('Invalid File Path')
|
||||
expect{ subject(path) }.to raise_error('Invalid File Path')
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
33
spec/services/file_path_sanitizer_spec.rb
Normal file
33
spec/services/file_path_sanitizer_spec.rb
Normal file
@@ -0,0 +1,33 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
require 'spec_helper'
|
||||
|
||||
describe FilePathSanitizer do
|
||||
let(:folder_path){ '/tmp/product_import123' }
|
||||
let(:file_path) { "#{folder_path}/import.csv" }
|
||||
|
||||
before do
|
||||
FileUtils.mkdir_p(folder_path)
|
||||
File.new(file_path, 'w') unless File.exist?(file_path)
|
||||
end
|
||||
let(:object) { described_class.new }
|
||||
|
||||
it 'should covert relative path to absolute' do
|
||||
path = "/tmp/product_import123/import.csv"
|
||||
expect(object.sanitize(path).to_s).to eq file_path
|
||||
|
||||
path1 = "/../../tmp/product_import123/import.csv"
|
||||
expect(object.sanitize(path1).to_s).to eq file_path
|
||||
|
||||
path2 = "/etc/../../../tmp/product_import123/import.csv"
|
||||
expect(object.sanitize(path2).to_s).to eq file_path
|
||||
end
|
||||
|
||||
it "call errors callback if the file doesn't exist" do
|
||||
path = '/tmp/product_import123/import1.csv'
|
||||
error_callback = double('error_callback')
|
||||
expect(error_callback).to receive(:call)
|
||||
|
||||
expect( object.sanitize(path, on_error: error_callback) ).to eq(false)
|
||||
end
|
||||
end
|
||||
Reference in New Issue
Block a user