mirror of
https://github.com/AstrBotDevs/AstrBot
synced 2026-07-16 01:40:15 +08:00
0d8e8682db
* refactor: migrate to fastapi * structure refactor * fix: pyright fix * refactor: improve error handling and public messages in plugin services * feat(api): refactor API client integration and enhance request handling - Updated API client configuration to use a dedicated HTTP client. - Introduced utility functions for generating options, queries, and form data for API requests. - Refactored multiple API methods to utilize the new utility functions for improved consistency and readability. - Renamed types for clarity and updated import statements accordingly. feat(docs): add script to update OpenAPI JSON from YAML spec - Created a Python script to convert OpenAPI YAML specification to JSON format. - The script supports customizable input and output paths. - Ensured the script handles directory creation for output paths and validates the YAML structure. * fix * feat(auth): implement rate limiting for v1 login endpoint and enhance request handling * Refactor dashboard API routers to use legacy_router for backward compatibility - Changed all instances of dashboard_router to legacy_router across multiple API modules including platform, plugins, providers, sessions, skills, stats, subagents, t2i, tools, updates, and asgi_runtime. - Updated route definitions to ensure existing endpoints remain functional under the new router structure. - Introduced support for Quart request context in asgi_runtime to enhance compatibility with existing Quart-based plugins. - Added a test case to validate the functionality of the new Quart request context handling in plugin extensions. * chore: remove cli test * fix: update dashboard tests for fastapi migration * chore: satisfy ruff checks * fix: update openapi api key scopes * fix: sync config scope chip selection * fix: restore quart dependency * docs: clarify quart plugin api compatibility * docs: update openapi scope documentation * fix: use singular skill openapi scope * fix: hide update service exception details * fix: address fastapi review comments * fix: address dashboard review findings * docs: revert unrelated package deployment changes * docs: update agent api generation guidance * feat: add plugin page web api helpers * docs: add plugin page bridge demo * fix: type plugin upload files * fix: stabilize plugin page uploads * fix: type plugin web request proxy * docs: remove plugin page docs example * fix: authenticate plugin page SSE bridge
32 lines
1.1 KiB
Python
32 lines
1.1 KiB
Python
"""Tests for upload filename sanitization."""
|
|
|
|
from astrbot.dashboard.services.chat_service import sanitize_upload_filename
|
|
|
|
|
|
def test_sanitize_upload_filename_strips_posix_traversal():
|
|
assert sanitize_upload_filename("../../outside.txt") == "outside.txt"
|
|
|
|
|
|
def test_sanitize_upload_filename_strips_windows_traversal():
|
|
assert sanitize_upload_filename(r"..\\..\\outside.txt") == "outside.txt"
|
|
|
|
|
|
def test_sanitize_upload_filename_strips_fakepath():
|
|
assert sanitize_upload_filename(r"C:\\fakepath\\photo.png") == "photo.png"
|
|
|
|
|
|
def test_sanitize_upload_filename_falls_back_for_empty_values():
|
|
generated = sanitize_upload_filename("")
|
|
|
|
assert generated
|
|
assert generated not in {".", ".."}
|
|
assert "/" not in generated
|
|
assert "\\" not in generated
|
|
|
|
|
|
def test_sanitize_upload_filename_removes_embedded_null_bytes():
|
|
assert sanitize_upload_filename("evil\x00.txt") == "evil.txt"
|
|
assert sanitize_upload_filename("\x00leading.txt") == "leading.txt"
|
|
assert sanitize_upload_filename("trailing\x00.txt\x00") == "trailing.txt"
|
|
assert sanitize_upload_filename("mid\x00dle.txt") == "middle.txt"
|