Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-02-27 17:11:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into develop

Browse Source
This commit is contained in:
Barış Soner Uşaklı
2025-07-24 11:55:39 -04:00
parent 8e9d38430c a8f4c5e63a
commit dcdda2a8c8
4 changed files with 53 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
test/files/dirty.svg Normal file
View File

@@ -0,0 +1,4 @@
<svg width="100" height="100" xmlns="http://www.w3.org/2000/svg">
<rect x="10" y="10" width="80" height="80" fill="red" stroke="black" stroke-width="4"/>
</svg>
<script>alert('foo');</script>
Side by Side

After

Width:  |  Height:  |  Size: 192 B

9
test/uploads.js
View File

@@ -338,6 +338,15 @@ describe('Upload Controllers', () => {
assert.equal(body[0].url, `${nconf.get('relative_path')}/assets/uploads/category/category-1.png`);
});
it('should upload svg as category image after cleaning it up', async () => {
const { response, body } = await helpers.uploadFile(`${nconf.get('url')}/api/admin/category/uploadpicture`, path.join(__dirname, '../test/files/dirty.svg'), { params: JSON.stringify({ cid: cid }) }, jar, csrf_token);
assert.equal(response.statusCode, 200);
assert(Array.isArray(body));
assert.equal(body[0].url, `${nconf.get('relative_path')}/assets/uploads/category/category-1.svg`);
const svgContents = await fs.readFile(path.join(__dirname, '../test/uploads/category/category-1.svg'), 'utf-8');
assert.strictEqual(svgContents.includes('<script>'), false);
});
it('should upload default avatar', async () => {
const { response, body } = await helpers.uploadFile(`${nconf.get('url')}/api/admin/uploadDefaultAvatar`, path.join(__dirname, '../test/files/test.png'), { }, jar, csrf_token);
assert.equal(response.statusCode, 200);