camilafagundesandCursor
6e23f1533b
O módulo usa a identidade Supabase, isola cada workspace e registra storage, TTL, runner e biblioteca XLSX como decisões ainda abertas. Co-authored-by: Cursor <cursoragent@cursor.com>
24 lines
1.1 KiB
TypeScript
24 lines
1.1 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { MemoryStorage } from "@/infra/storage/memory";
|
|
import { detectSpreadsheetFormat } from "@/domain/spreadsheet-adapter/file-signature";
|
|
import { assertZipSafe } from "@/domain/spreadsheet-adapter/file-signature";
|
|
|
|
describe("hardening de arquivo", () => {
|
|
it("rejeita path traversal, extensão enganosa e zip anômalo", async () => {
|
|
const storage = new MemoryStorage();
|
|
await expect(storage.put("../segredo", Buffer.from("x"))).rejects.toMatchObject({ code: "PATH_TRAVERSAL" });
|
|
const zip = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
|
|
expect(() => detectSpreadsheetFormat("dados.csv", zip)).toThrow(/CSV/);
|
|
expect(() => detectSpreadsheetFormat("legado.xls", Buffer.from("a,b"))).toThrow(/XLS/);
|
|
const bomb = Buffer.alloc(64);
|
|
bomb.writeUInt32LE(0x04034b50, 0);
|
|
bomb.writeUInt16LE(0, 8);
|
|
bomb.writeUInt32LE(10, 18);
|
|
bomb.writeUInt32LE(400_000_000, 22);
|
|
bomb.writeUInt16LE(1, 26);
|
|
bomb.writeUInt16LE(0, 28);
|
|
bomb.write("a", 30);
|
|
expect(() => assertZipSafe(bomb)).toThrow(/limite seguro|compressão/i);
|
|
});
|
|
});
|