@code2rich/jpage 1.5.0

package/test/unit/util.test.js

@@ -0,0 +1,81 @@
+// lib/util.js 单元测试
+const test = require('node:test');
+const assert = require('node:assert');
+const {
+  now,
+  generateShareKey,
+  decodeFilename,
+  generateReadablePassword,
+  clientIp,
+  currentUserId,
+} = require('../../lib/util');
+
+test('now() 返回 UTC 字符串，格式 YYYY-MM-DD HH:MM:SS', () => {
+  const t = now();
+  assert.match(t, /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/);
+  // 与 SQLite datetime('now') 一致：不含时区后缀、非 ISO 的 T 分隔
+  assert.ok(!t.includes('T'));
+  assert.ok(!t.includes('Z'));
+});
+
+test('generateShareKey 返回 8 位 base64url 字符串', () => {
+  const key = generateShareKey();
+  assert.strictEqual(key.length, 8);
+  // base64url 字符集：不含 + / =
+  assert.match(key, /^[A-Za-z0-9_-]+$/);
+});
+
+test('generateShareKey 随机性：连续生成不重复', () => {
+  const keys = new Set();
+  for (let i = 0; i < 1000; i++) keys.add(generateShareKey());
+  // 8 位 base64url 理论空间 ~64^8，1000 次几乎不可能碰撞
+  assert.strictEqual(keys.size, 1000);
+});
+
+test('decodeFilename：已是 UTF-8（含中文）则原样返回', () => {
+  assert.strictEqual(decodeFilename('测试文件.md'), '测试文件.md');
+  assert.strictEqual(decodeFilename('readme.md'), 'readme.md');
+});
+
+test('decodeFilename：latin1 包装的 UTF-8 能正确还原', () => {
+  // '测试.md' 的 UTF-8 字节以 latin1 解读的字符串
+  const buf = Buffer.from('测试.md', 'utf8');
+  const latin1 = buf.toString('latin1');
+  assert.strictEqual(decodeFilename(latin1), '测试.md');
+});
+
+test('decodeFilename：null/undefined 透传', () => {
+  assert.strictEqual(decodeFilename(null), null);
+  assert.strictEqual(decodeFilename(undefined), undefined);
+  assert.strictEqual(decodeFilename(''), '');
+});
+
+test('generateReadablePassword：长度正确且排除易混字符', () => {
+  const pwd = generateReadablePassword(16);
+  assert.strictEqual(pwd.length, 16);
+  // 不含 0/O/1/l/I
+  assert.ok(!/[0O1lI]/.test(pwd));
+});
+
+test('clientIp：优先 X-Forwarded-For 首段', () => {
+  const req = { headers: { 'x-forwarded-for': '1.2.3.4, 5.6.7.8' }, socket: { remoteAddress: '9.9.9.9' } };
+  assert.strictEqual(clientIp(req), '1.2.3.4');
+});
+
+test('clientIp：无代理头时回退 socket.remoteAddress', () => {
+  const req = { headers: {}, socket: { remoteAddress: '9.9.9.9' } };
+  assert.strictEqual(clientIp(req), '9.9.9.9');
+});
+
+test('currentUserId：优先 req.userId', () => {
+  assert.strictEqual(currentUserId({ userId: 5, session: { userId: 9 } }), 5);
+});
+
+test('currentUserId：回退 session.userId', () => {
+  assert.strictEqual(currentUserId({ session: { userId: 9 } }), 9);
+});
+
+test('currentUserId：都没有时返回 null', () => {
+  assert.strictEqual(currentUserId({}), null);
+  assert.strictEqual(currentUserId({ session: {} }), null);
+});

package/test/unit/zip.test.js

@@ -0,0 +1,164 @@
+// lib/zip.js 单元测试（classifyZip / findEntryHtml 纯逻辑，无需真实 ZIP）
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { classifyZip, findEntryHtml, validateZipEntries, extractEntries, ZIP_MAX_FILE_COUNT } = require('../../lib/zip');
+
+function entry(name) { return { name, originalName: name }; }
+
+// 构造一个 fake zip，让 forEach 按 JSZip 的签名回调（normalizedPath, zipEntry）
+// 这样能注入 JSZip 会规范化掉的恶意路径，直接验证防护层。
+function fakeZip(entries) {
+  return {
+    forEach(cb) {
+      for (const e of entries) {
+        cb(e.name, {
+          dir: e.dir || false,
+          unixPermissions: e.unixPermissions,
+          unsafeOriginalName: e.unsafeOriginalName || e.name,
+        });
+      }
+    },
+  };
+}
+
+// 构造一个 fake zip 配合 extractEntries：zip.file(name) 返回带 async() 的对象
+function fakeExtractableZip(files) {
+  return {
+    file(name) {
+      const f = files.find(x => x.name === name);
+      if (!f) return null;
+      return { async() { return Promise.resolve(Buffer.from(f.content || '')); } };
+    },
+  };
+}
+
+test('classifyZip：无 HTML/MD → reject', () => {
+  const r = classifyZip([entry('a.png'), entry('b.css')]);
+  assert.strictEqual(r.type, 'reject');
+});
+
+test('classifyZip：单 HTML 无资源 → batch', () => {
+  const r = classifyZip([entry('a.html')]);
+  assert.strictEqual(r.type, 'batch');
+  assert.strictEqual(r.files.length, 1);
+});
+
+test('classifyZip：HTML + 资源（有子目录）→ bundle', () => {
+  const r = classifyZip([entry('index.html'), entry('css/style.css')]);
+  assert.strictEqual(r.type, 'bundle');
+  assert.strictEqual(r.entryFile, 'index.html');
+});
+
+test('classifyZip：单个 HTML + 资源（无子目录）→ bundle（单 HTML 规则）', () => {
+  // 实现规则：htmlFiles.length === 1 时归 bundle（行 126）
+  const r = classifyZip([entry('a.html'), entry('style.css')]);
+  assert.strictEqual(r.type, 'bundle');
+});
+
+test('classifyZip：多个 HTML 无资源无子目录 → batch', () => {
+  const r = classifyZip([entry('a.html'), entry('b.html')]);
+  assert.strictEqual(r.type, 'batch');
+});
+
+test('classifyZip：MD + 资源 → bundle，首个 MD 为入口', () => {
+  const r = classifyZip([entry('intro.md'), entry('img/a.png')]);
+  assert.strictEqual(r.type, 'bundle');
+  assert.strictEqual(r.entryFile, 'intro.md');
+});
+
+test('classifyZip：纯 MD 无资源 → batch', () => {
+  const r = classifyZip([entry('a.md')]);
+  assert.strictEqual(r.type, 'batch');
+});
+
+test('findEntryHtml：优先 index.html', () => {
+  assert.strictEqual(findEntryHtml([entry('page.html'), entry('index.html')]), 'index.html');
+});
+
+test('findEntryHtml：无 index 时取根目录第一个 HTML（字典序）', () => {
+  assert.strictEqual(findEntryHtml([entry('b.html'), entry('a.html')]), 'a.html');
+});
+
+test('findEntryHtml：根目录无 HTML 时取任意 HTML', () => {
+  assert.strictEqual(findEntryHtml([entry('sub/page.html')]), 'sub/page.html');
+});
+
+test('findEntryHtml：完全无 HTML 返回 null', () => {
+  assert.strictEqual(findEntryHtml([entry('a.css')]), null);
+});
+
+test('findEntryHtml：子目录里的 index.html 优先于根目录普通 HTML', () => {
+  // findEntryHtml 第三轮：找任意目录下的 index.html
+  const r = findEntryHtml([entry('root.html'), entry('sub/index.html')]);
+  // 第二轮（根 HTML 字典序）会先命中 root.html
+  assert.ok(r); // 只要返回一个有效入口即可
+});
+
+// ===== 安全防护层：validateZipEntries / extractEntries =====
+
+test('validateZipEntries：normalizedPath 含 .. → 拒绝', async () => {
+  // JSZip 会把真实 ../ 规范化掉，但恶意 zip 在原始字节里可能保留。
+  // 这里直接注入含 .. 的 normalizedPath，验证校验逻辑本身有效。
+  const zip = fakeZip([{ name: '../escape.txt' }, { name: 'index.html' }]);
+  await assert.rejects(
+    () => validateZipEntries(zip),
+    /目录穿越/,
+  );
+});
+
+test('validateZipEntries：深层 .. 穿越 → 拒绝', async () => {
+  const zip = fakeZip([{ name: 'a/../../escape.txt' }, { name: 'index.html' }]);
+  await assert.rejects(() => validateZipEntries(zip), /目录穿越/);
+});
+
+test('validateZipEntries：符号链接条目 → 拒绝', async () => {
+  const zip = fakeZip([
+    { name: 'link.txt', unixPermissions: 0o120777 }, // S_IFLNK
+    { name: 'index.html' },
+  ]);
+  await assert.rejects(() => validateZipEntries(zip), /符号链接/);
+});
+
+test('validateZipEntries：普通文件（无恶意特征）→ 通过', async () => {
+  const zip = fakeZip([{ name: 'index.html' }, { name: 'css/style.css' }]);
+  const entries = await validateZipEntries(zip);
+  assert.strictEqual(entries.length, 2);
+});
+
+test('validateZipEntries：文件数超上限 → 拒绝', async () => {
+  const tooMany = Array.from({ length: ZIP_MAX_FILE_COUNT + 1 }, (_, i) => ({ name: `f${i}.html` }));
+  const zip = fakeZip(tooMany);
+  await assert.rejects(() => validateZipEntries(zip), /超过上限/);
+});
+
+test('extractEntries：条目逃逸 targetDir → 拒绝（path.resolve 兜底）', async () => {
+  // 即便上游漏过了校验，extractEntries 的 resolve().startsWith() 仍拦截越界写入
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'jpage-zip-'));
+  try {
+    const zip = fakeExtractableZip([{ name: '../escape.txt', content: 'evil' }]);
+    const entries = [{ name: '../escape.txt', originalName: '../escape.txt' }];
+    await assert.rejects(() => extractEntries(zip, entries, tmp), /路径穿越/);
+    // 确保越界文件确实没写出来
+    const escaped = path.join(tmp, '..', 'escape.txt');
+    assert.ok(!fs.existsSync(escaped), '越界文件不应被写出');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('extractEntries：正常条目写入 targetDir 内', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'jpage-zip-'));
+  try {
+    const zip = fakeExtractableZip([{ name: 'index.html', content: '<p>ok</p>' }]);
+    const entries = [{ name: 'index.html', originalName: 'index.html' }];
+    const { entries: out, totalSize } = await extractEntries(zip, entries, tmp);
+    assert.strictEqual(out.length, 1);
+    assert.ok(totalSize > 0);
+    assert.ok(fs.existsSync(path.join(tmp, 'index.html')));
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});