mirror of
https://github.com/mattermost/mattermost.git
synced 2026-05-21 17:55:26 -04:00
* MM-26425: Make URL parsing for image proxy more robust - We don't bypass protocol relative URLs. - We don't bypass hostnames with a similar prefix. https: //mattermost.atlassian.net/browse/MM-26425 ```release-note NONE ``` * fix tests and incorporate review comments * Handle opaque URLs * Fix path tests Co-authored-by: Mattermod <mattermod@users.noreply.github.com>
112 lines
3.4 KiB
Go
112 lines
3.4 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package imageproxy
|
|
|
|
import (
|
|
"net/url"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestGetProxiedImageURL(t *testing.T) {
|
|
siteURL := "https://mattermost.example.com"
|
|
parsedURL, err := url.Parse(siteURL)
|
|
require.NoError(t, err)
|
|
|
|
imageURL := "http://www.mattermost.org/wp-content/uploads/2016/03/logoHorizontal.png"
|
|
proxiedURL := "https://mattermost.example.com/api/v4/image?url=http%3A%2F%2Fwww.mattermost.org%2Fwp-content%2Fuploads%2F2016%2F03%2FlogoHorizontal.png"
|
|
|
|
proxy := ImageProxy{siteURL: parsedURL}
|
|
|
|
for _, test := range []struct {
|
|
Name string
|
|
Input string
|
|
Expected string
|
|
}{
|
|
{
|
|
Name: "should proxy an image",
|
|
Input: imageURL,
|
|
Expected: proxiedURL,
|
|
},
|
|
{
|
|
Name: "should not proxy a relative image",
|
|
Input: "/static/logo.png",
|
|
Expected: "https://mattermost.example.com/static/logo.png",
|
|
},
|
|
{
|
|
Name: "should bypass opaque URLs",
|
|
Input: "http:xyz123?query",
|
|
Expected: siteURL,
|
|
},
|
|
{
|
|
Name: "should not proxy an image on the Mattermost server",
|
|
Input: "https://mattermost.example.com/static/logo.png",
|
|
Expected: "https://mattermost.example.com/static/logo.png",
|
|
},
|
|
{
|
|
Name: "should not proxy an image that has already been proxied",
|
|
Input: proxiedURL,
|
|
Expected: proxiedURL,
|
|
},
|
|
{
|
|
Name: "should not bypass protocol relative URLs",
|
|
Input: "//mattermost.org/static/logo.png",
|
|
Expected: "https://mattermost.example.com/api/v4/image?url=https%3A%2F%2Fmattermost.org%2Fstatic%2Flogo.png",
|
|
},
|
|
{
|
|
Name: "should not bypass if the host prefix is same",
|
|
Input: "https://mattermost.example.com.anothersite.com/static/logo.png",
|
|
Expected: "https://mattermost.example.com/api/v4/image?url=https%3A%2F%2Fmattermost.example.com.anothersite.com%2Fstatic%2Flogo.png",
|
|
},
|
|
{
|
|
Name: "should not bypass for user auth URLs",
|
|
Input: "https://mattermost.example.com@anothersite.com/static/logo.png",
|
|
Expected: "https://mattermost.example.com/api/v4/image?url=https%3A%2F%2Fmattermost.example.com%40anothersite.com%2Fstatic%2Flogo.png",
|
|
},
|
|
} {
|
|
t.Run(test.Name, func(t *testing.T) {
|
|
assert.Equal(t, test.Expected, proxy.GetProxiedImageURL(test.Input))
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestGetUnproxiedImageURL(t *testing.T) {
|
|
siteURL := "https://mattermost.example.com"
|
|
|
|
imageURL := "http://www.mattermost.org/wp-content/uploads/2016/03/logoHorizontal.png"
|
|
proxiedURL := "https://mattermost.example.com/api/v4/image?url=http%3A%2F%2Fwww.mattermost.org%2Fwp-content%2Fuploads%2F2016%2F03%2FlogoHorizontal.png"
|
|
|
|
for _, test := range []struct {
|
|
Name string
|
|
Input string
|
|
Expected string
|
|
}{
|
|
{
|
|
Name: "should remove proxy",
|
|
Input: proxiedURL,
|
|
Expected: imageURL,
|
|
},
|
|
{
|
|
Name: "should not remove proxy from a relative image",
|
|
Input: "/static/logo.png",
|
|
Expected: "/static/logo.png",
|
|
},
|
|
{
|
|
Name: "should not remove proxy from an image on the Mattermost server",
|
|
Input: "https://mattermost.example.com/static/logo.png",
|
|
Expected: "https://mattermost.example.com/static/logo.png",
|
|
},
|
|
{
|
|
Name: "should not remove proxy from a non-proxied image",
|
|
Input: imageURL,
|
|
Expected: imageURL,
|
|
},
|
|
} {
|
|
t.Run(test.Name, func(t *testing.T) {
|
|
assert.Equal(t, test.Expected, getUnproxiedImageURL(test.Input, siteURL))
|
|
})
|
|
}
|
|
}
|