Files
Matt Van Horn a0cef76d72 fix(files_sharing): validate input in PublicPreviewController#getPreview
Return 400 Bad Request when the file parameter is empty and the shared
node is a folder, instead of passing the folder itself to getPreview
which triggers an internal server error.

Also rename the local variable to $fileNode to prevent the catch block
from calling getMimeType() on the original string parameter when
get() throws NotFoundException.

Fixes #59229

Assisted-by: ClaudeCode:claude-opus-4-6
Assisted-by: ClaudeCode:claude-opus-5

Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Signed-off-by: Josh <josh.t.richards@gmail.com>
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>

# Conflicts:
#	apps/files_sharing/lib/Controller/PublicPreviewController.php

# Conflicts:
#	apps/files_sharing/lib/Controller/PublicPreviewController.php
2026-08-13 11:14:22 +02:00

408 lines
12 KiB
PHP

<?php
/**
* SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
* SPDX-License-Identifier: AGPL-3.0-or-later
*/
namespace OCA\Files_Sharing\Tests\Controller;
use OCA\Files_Sharing\Controller\PublicPreviewController;
use OCP\AppFramework\Http;
use OCP\AppFramework\Http\DataResponse;
use OCP\AppFramework\Http\FileDisplayResponse;
use OCP\AppFramework\Http\RedirectResponse;
use OCP\AppFramework\Utility\ITimeFactory;
use OCP\Constants;
use OCP\Files\File;
use OCP\Files\Folder;
use OCP\Files\NotFoundException;
use OCP\Files\SimpleFS\ISimpleFile;
use OCP\IPreview;
use OCP\IRequest;
use OCP\ISession;
use OCP\Preview\IMimeIconProvider;
use OCP\Share\Exceptions\ShareNotFound;
use OCP\Share\IManager;
use OCP\Share\IShare;
use PHPUnit\Framework\MockObject\MockObject;
use Test\TestCase;
class PublicPreviewControllerTest extends TestCase {
private IPreview&MockObject $previewManager;
private IManager&MockObject $shareManager;
private ITimeFactory&MockObject $timeFactory;
private IRequest&MockObject $request;
private IMimeIconProvider&MockObject $mimeIconProvider;
private PublicPreviewController $controller;
protected function setUp(): void {
parent::setUp();
$this->previewManager = $this->createMock(IPreview::class);
$this->shareManager = $this->createMock(IManager::class);
$this->timeFactory = $this->createMock(ITimeFactory::class);
$this->request = $this->createMock(IRequest::class);
$this->mimeIconProvider = $this->createMock(IMimeIconProvider::class);
$this->timeFactory->method('getTime')
->willReturn(1337);
$this->overwriteService(ITimeFactory::class, $this->timeFactory);
$this->controller = new PublicPreviewController(
'files_sharing',
$this->request,
$this->shareManager,
$this->createMock(ISession::class),
$this->previewManager,
$this->mimeIconProvider,
);
}
public function testInvalidToken(): void {
$res = $this->controller->getPreview('', 'file', 10, 10);
$expected = new DataResponse([], Http::STATUS_BAD_REQUEST);
$this->assertEquals($expected, $res);
}
public function testInvalidWidth(): void {
$res = $this->controller->getPreview('token', 'file', 0);
$expected = new DataResponse([], Http::STATUS_BAD_REQUEST);
$this->assertEquals($expected, $res);
}
public function testInvalidHeight(): void {
$res = $this->controller->getPreview('token', 'file', 10, 0);
$expected = new DataResponse([], Http::STATUS_BAD_REQUEST);
$this->assertEquals($expected, $res);
}
public function testInvalidShare(): void {
$this->shareManager->method('getShareByToken')
->with($this->equalTo('token'))
->willThrowException(new ShareNotFound());
$res = $this->controller->getPreview('token', 'file', 10, 10);
$expected = new DataResponse([], Http::STATUS_NOT_FOUND);
$this->assertEquals($expected, $res);
}
public function testShareNotAccessable(): void {
$share = $this->createMock(IShare::class);
$this->shareManager->method('getShareByToken')
->with($this->equalTo('token'))
->willReturn($share);
$share->method('getPermissions')
->willReturn(0);
$res = $this->controller->getPreview('token', 'file', 10, 10);
$expected = new DataResponse([], Http::STATUS_FORBIDDEN);
$this->assertEquals($expected, $res);
}
public function testShareNoDownload() {
$share = $this->createMock(IShare::class);
$this->shareManager->method('getShareByToken')
->with($this->equalTo('token'))
->willReturn($share);
$share->method('getPermissions')
->willReturn(Constants::PERMISSION_READ);
$share->method('canSeeContent')
->willReturn(false);
$res = $this->controller->getPreview('token', 'file', 10, 10);
$expected = new DataResponse([], Http::STATUS_FORBIDDEN);
$this->assertEquals($expected, $res);
}
public function testShareNoDownloadButPreviewHeader() {
$share = $this->createMock(IShare::class);
$this->shareManager->method('getShareByToken')
->with($this->equalTo('token'))
->willReturn($share);
$share->method('getPermissions')
->willReturn(Constants::PERMISSION_READ);
$share->method('canSeeContent')
->willReturn(false);
$this->request->method('getHeader')
->with('x-nc-preview')
->willReturn('true');
$file = $this->createMock(File::class);
$share->method('getNode')
->willReturn($file);
$preview = $this->createMock(ISimpleFile::class);
$preview->method('getName')->willReturn('name');
$preview->method('getMTime')->willReturn(42);
$this->previewManager->method('getPreview')
->with($this->equalTo($file), 10, 10, false)
->willReturn($preview);
$preview->method('getMimeType')
->willReturn('myMime');
$res = $this->controller->getPreview('token', 'file', 10, 10, true, false);
$expected = new FileDisplayResponse($preview, Http::STATUS_OK, ['Content-Type' => 'myMime']);
$expected->cacheFor(15 * 60);
$this->assertEquals($expected, $res);
}
public function testShareWithAttributes() {
$share = $this->createMock(IShare::class);
$this->shareManager->method('getShareByToken')
->with($this->equalTo('token'))
->willReturn($share);
$share->method('getPermissions')
->willReturn(Constants::PERMISSION_READ);
$share->method('canSeeContent')
->willReturn(true);
$this->request->method('getHeader')
->with('x-nc-preview')
->willReturn('true');
$file = $this->createMock(File::class);
$share->method('getNode')
->willReturn($file);
$preview = $this->createMock(ISimpleFile::class);
$preview->method('getName')->willReturn('name');
$preview->method('getMTime')->willReturn(42);
$this->previewManager->method('getPreview')
->with($this->equalTo($file), 10, 10, false)
->willReturn($preview);
$preview->method('getMimeType')
->willReturn('myMime');
$res = $this->controller->getPreview('token', 'file', 10, 10, true, false);
$expected = new FileDisplayResponse($preview, Http::STATUS_OK, ['Content-Type' => 'myMime']);
$expected->cacheFor(3600 * 24);
$this->assertEquals($expected, $res);
}
public function testPreviewFile() {
$share = $this->createMock(IShare::class);
$this->shareManager->method('getShareByToken')
->with($this->equalTo('token'))
->willReturn($share);
$share->method('getPermissions')
->willReturn(Constants::PERMISSION_READ);
$file = $this->createMock(File::class);
$share->method('getNode')
->willReturn($file);
$share->method('canSeeContent')
->willReturn(true);
$preview = $this->createMock(ISimpleFile::class);
$preview->method('getName')->willReturn('name');
$preview->method('getMTime')->willReturn(42);
$this->previewManager->method('getPreview')
->with($this->equalTo($file), 10, 10, false)
->willReturn($preview);
$preview->method('getMimeType')
->willReturn('myMime');
$res = $this->controller->getPreview('token', 'file', 10, 10, true, false);
$expected = new FileDisplayResponse($preview, Http::STATUS_OK, ['Content-Type' => 'myMime']);
$expected->cacheFor(3600 * 24);
$this->assertEquals($expected, $res);
}
public function testPreviewFolderInvalidFile(): void {
$share = $this->createMock(IShare::class);
$this->shareManager->method('getShareByToken')
->with($this->equalTo('token'))
->willReturn($share);
$share->method('getPermissions')
->willReturn(Constants::PERMISSION_READ);
$folder = $this->createMock(Folder::class);
$share->method('getNode')
->willReturn($folder);
$share->method('canSeeContent')
->willReturn(true);
$folder->method('get')
->with($this->equalTo('file'))
->willThrowException(new NotFoundException());
$res = $this->controller->getPreview('token', 'file', 10, 10, true, false);
$expected = new DataResponse([], Http::STATUS_NOT_FOUND);
$this->assertEquals($expected, $res);
}
public function testPreviewFolderEmptyFileReturnsBadRequest(): void {
$share = $this->createMock(IShare::class);
$this->shareManager->method('getShareByToken')
->with($this->equalTo('token'))
->willReturn($share);
$share->method('getPermissions')
->willReturn(Constants::PERMISSION_READ);
$folder = $this->createMock(Folder::class);
$share->method('getNode')
->willReturn($folder);
$share->method('canSeeContent')
->willReturn(true);
$res = $this->controller->getPreview('token', '', 10, 10, false, false);
$expected = new DataResponse([], Http::STATUS_BAD_REQUEST);
$this->assertEquals($expected, $res);
}
public function testPreviewFolderSubfolderReturnsBadRequest(): void {
$share = $this->createMock(IShare::class);
$this->shareManager->method('getShareByToken')
->with($this->equalTo('token'))
->willReturn($share);
$share->method('getPermissions')
->willReturn(Constants::PERMISSION_READ);
$folder = $this->createMock(Folder::class);
$share->method('getNode')
->willReturn($folder);
$share->method('canSeeContent')
->willReturn(true);
$subfolder = $this->createMock(Folder::class);
$folder->method('get')
->with($this->equalTo('nested'))
->willReturn($subfolder);
$res = $this->controller->getPreview('token', 'nested', 10, 10, false, false);
$expected = new DataResponse([], Http::STATUS_BAD_REQUEST);
$this->assertEquals($expected, $res);
}
public function testPreviewFolderInvalidFileWithMimeFallbackReturnsNotFound(): void {
$share = $this->createMock(IShare::class);
$this->shareManager->method('getShareByToken')
->with($this->equalTo('token'))
->willReturn($share);
$share->method('getPermissions')
->willReturn(Constants::PERMISSION_READ);
$folder = $this->createMock(Folder::class);
$share->method('getNode')
->willReturn($folder);
$share->method('canSeeContent')
->willReturn(true);
$folder->method('get')
->with($this->equalTo('file'))
->willThrowException(new NotFoundException());
$this->mimeIconProvider->expects($this->never())
->method('getMimeIconUrl');
$res = $this->controller->getPreview('token', 'file', 10, 10, false, true);
$expected = new DataResponse([], Http::STATUS_NOT_FOUND);
$this->assertEquals($expected, $res);
}
public function testPreviewFolderValidFileMimeFallbackRedirectsWhenPreviewMissing(): void {
$share = $this->createMock(IShare::class);
$this->shareManager->method('getShareByToken')
->with($this->equalTo('token'))
->willReturn($share);
$share->method('getPermissions')
->willReturn(Constants::PERMISSION_READ);
$folder = $this->createMock(Folder::class);
$share->method('getNode')
->willReturn($folder);
$share->method('canSeeContent')
->willReturn(true);
$file = $this->createMock(File::class);
$folder->method('get')
->with($this->equalTo('file'))
->willReturn($file);
$file->method('getMimeType')
->willReturn('text/plain');
$this->previewManager->method('getPreview')
->with($this->equalTo($file), 10, 10, true)
->willThrowException(new NotFoundException());
$this->mimeIconProvider->method('getMimeIconUrl')
->with('text/plain')
->willReturn('/icon-url');
$res = $this->controller->getPreview('token', 'file', 10, 10, false, true);
$expected = new RedirectResponse('/icon-url');
$this->assertEquals($expected, $res);
}
public function testPreviewFolderValidFile(): void {
$share = $this->createMock(IShare::class);
$this->shareManager->method('getShareByToken')
->with($this->equalTo('token'))
->willReturn($share);
$share->method('getPermissions')
->willReturn(Constants::PERMISSION_READ);
$folder = $this->createMock(Folder::class);
$share->method('getNode')
->willReturn($folder);
$share->method('canSeeContent')
->willReturn(true);
$file = $this->createMock(File::class);
$folder->method('get')
->with($this->equalTo('file'))
->willReturn($file);
$preview = $this->createMock(ISimpleFile::class);
$preview->method('getName')->willReturn('name');
$preview->method('getMTime')->willReturn(42);
$this->previewManager->method('getPreview')
->with($this->equalTo($file), 10, 10, false)
->willReturn($preview);
$preview->method('getMimeType')
->willReturn('myMime');
$res = $this->controller->getPreview('token', 'file', 10, 10, true, false);
$expected = new FileDisplayResponse($preview, Http::STATUS_OK, ['Content-Type' => 'myMime']);
$expected->cacheFor(3600 * 24);
$this->assertEquals($expected, $res);
}
}