Fix: drive/files 系の type の validater Fix #2386

sakura-tel · Jan 9, 2023 · ea2bc3f · ea2bc3f
1 parent 22f9ea5
commit ea2bc3f
Show file tree

Hide file tree

Showing 4 changed files with 61 additions and 2 deletions.
diff --git a/src/misc/mime-type-filter.ts b/src/misc/mime-type-filter.ts
@@ -0,0 +1 @@
+export const typeFilterValidater = /^([a-z]+)[/]([*]|[0-9A-Za-z+.-]+)$/;
diff --git a/src/server/api/endpoints/drive/files.ts b/src/server/api/endpoints/drive/files.ts
@@ -3,6 +3,7 @@ import { ID } from '../../../../misc/cafy-id';
 import define from '../../define';
 import { DriveFiles } from '../../../../models';
 import { makePaginationQuery } from '../../common/make-pagination-query';
+import { typeFilterValidater } from '../../../../misc/mime-type-filter';
 
 export const meta = {
 	desc: {
@@ -36,7 +37,7 @@ export const meta = {
 		},
 
 		type: {
-			validator: $.optional.str.match(/^[a-zA-Z\/\-*]+$/)
+			validator: $.optional.str.match(typeFilterValidater)
 		}
 	},
 

diff --git a/src/server/api/endpoints/drive/stream.ts b/src/server/api/endpoints/drive/stream.ts
@@ -3,6 +3,7 @@ import { ID } from '../../../../misc/cafy-id';
 import define from '../../define';
 import { DriveFiles } from '../../../../models';
 import { makePaginationQuery } from '../../common/make-pagination-query';
+import { typeFilterValidater } from '../../../../misc/mime-type-filter';
 
 export const meta = {
 	tags: ['drive'],
@@ -26,7 +27,7 @@ export const meta = {
 		},
 
 		type: {
-			validator: $.optional.str.match(/^[a-zA-Z\/\-*]+$/)
+			validator: $.optional.str.match(typeFilterValidater)
 		}
 	},
 

diff --git a/test/mime-type-filter.ts b/test/mime-type-filter.ts
@@ -0,0 +1,56 @@
+import * as assert from 'assert';
+import { typeFilterValidater } from '../src/misc/mime-type-filter';
+
+describe('typeFilterValidater', () => {
+	it('Allow image/jpeg', () => {
+		assert.strictEqual(typeFilterValidater.test('image/jpeg'), true);
+	});
+
+	it('Allow image/*', () => {
+		assert.strictEqual(typeFilterValidater.test('image/*'), true);
+	});
+
+	it('Reject image/a*', () => {
+		assert.strictEqual(typeFilterValidater.test('image/a*'), false);
+	});
+
+	it('Reject image/a*b*c', () => {
+		assert.strictEqual(typeFilterValidater.test('image/a*b*c'), false);
+	});
+
+	it('Reject image*/jpeg', () => {
+		assert.strictEqual(typeFilterValidater.test('image*/jpeg'), false);
+	});
+
+	it('Reject image/*/*', () => {
+		assert.strictEqual(typeFilterValidater.test('image/*/*'), false);
+	});
+
+	it('Allow video/mp4', () => {
+		assert.strictEqual(typeFilterValidater.test('video/mp4'), true);
+	});
+
+	it('Allow video/MP1S', () => {
+		assert.strictEqual(typeFilterValidater.test('video/MP1S'), true);
+	});
+
+	it('Allow image/x-icon', () => {
+		assert.strictEqual(typeFilterValidater.test('image/x-icon'), true);
+	});
+
+	it('Allow image/svg+xml', () => {
+		assert.strictEqual(typeFilterValidater.test('image/svg+xml'), true);
+	});
+
+	it('Allow audio/vnd.wave', () => {
+		assert.strictEqual(typeFilterValidater.test('audio/vnd.wave'), true);
+	});
+
+	it('Reject %', () => {
+		assert.strictEqual(typeFilterValidater.test('image/%'), false);
+	});
+
+	it('Reject _', () => {
+		assert.strictEqual(typeFilterValidater.test('image/_'), false);
+	});
+});