arsvendg/Stirling-PDF
1
0
Fork 0
mirror of https://github.com/arsvendg/Stirling-PDF.git synced 2026-07-15 11:00:47 +02:00
Code Issues Actions 3 Packages Projects Releases 1 Wiki Activity

hardening (#5807)

Browse Source 
Co-authored-by: Claude Haiku 4.5 <[email protected]>
This commit is contained in:
Anthony Stirling
2026-03-02 13:56:39 +00:00
committed by GitHub
co-authored by Claude Haiku 4.5
parent 8b25db37ad
commit 012bd1af92
21 changed files with 407 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/core/src/test/java/stirling/software/common/controller/JobControllerTest.java
+32
View File
@@ -15,11 +15,13 @@ import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.mock.web.MockHttpSession;
import org.springframework.test.util.ReflectionTestUtils;
import jakarta.servlet.http.HttpServletRequest;
import stirling.software.common.model.job.JobResult;
import stirling.software.common.service.FileStorage;
import stirling.software.common.service.JobOwnershipService;
import stirling.software.common.service.JobQueue;
import stirling.software.common.service.TaskManager;
@@ -33,6 +35,8 @@ class JobControllerTest {
@Mock private HttpServletRequest request;
@Mock private JobOwnershipService jobOwnershipService;
private MockHttpSession session;
@InjectMocks private JobController controller;
@@ -404,4 +408,32 @@ class JobControllerTest {
verify(taskManager).setError(jobId, "Job was cancelled by user");
}
@Test
void testDownloadFile_ForbiddenWhenFileOwnedByAnotherUser() throws Exception {
String fileId = "file-id";
ReflectionTestUtils.setField(controller, "jobOwnershipService", jobOwnershipService);
when(taskManager.findJobKeyByFileId(fileId)).thenReturn("other-user:job-id");
when(jobOwnershipService.validateJobAccess("other-user:job-id")).thenReturn(false);
ResponseEntity<?> response = controller.downloadFile(fileId);
assertEquals(HttpStatus.FORBIDDEN, response.getStatusCode());
verify(fileStorage, never()).retrieveBytes(eq(fileId));
}
@Test
void testGetFileMetadata_ForbiddenWhenFileOwnedByAnotherUser() throws Exception {
String fileId = "file-id";
ReflectionTestUtils.setField(controller, "jobOwnershipService", jobOwnershipService);
when(taskManager.findJobKeyByFileId(fileId)).thenReturn("other-user:job-id");
when(jobOwnershipService.validateJobAccess("other-user:job-id")).thenReturn(false);
ResponseEntity<?> response = controller.getFileMetadata(fileId);
assertEquals(HttpStatus.FORBIDDEN, response.getStatusCode());
verify(fileStorage, never()).getFileSize(eq(fileId));
}
}