mirror of https://github.com/docusealco/docuseal
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
78 lines
2.8 KiB
78 lines
2.8 KiB
# frozen_string_literal: true
|
|
|
|
require 'rails_helper'
|
|
|
|
RSpec.describe 'Account logo', type: :request do
|
|
let!(:account) { create(:account) }
|
|
let!(:admin) { create(:user, account: account, email: 'admin@wabo.cc') }
|
|
|
|
before { sign_in admin }
|
|
|
|
def upload(content_type:, bytes:, filename: 'logo.png')
|
|
tempfile = Tempfile.new(['logo', File.extname(filename)])
|
|
tempfile.binmode
|
|
tempfile.write(bytes)
|
|
tempfile.rewind
|
|
Rack::Test::UploadedFile.new(tempfile.path, content_type)
|
|
end
|
|
|
|
describe 'POST /settings/account_logo' do
|
|
it 'accepts a PNG upload and attaches it to the current account' do
|
|
png_bytes = Rails.public_path.join('favicon-32x32.png').binread
|
|
|
|
expect do
|
|
post settings_account_logo_path, params: { logo: upload(content_type: 'image/png', bytes: png_bytes) }
|
|
end.to change { account.reload.logo.attached? }.from(false).to(true)
|
|
|
|
expect(response).to redirect_to(settings_personalization_path)
|
|
expect(flash[:notice]).to include('Logo updated')
|
|
end
|
|
|
|
it 'rejects an unsupported content type' do
|
|
pdf_bytes = '%PDF-1.4 dummy'
|
|
|
|
post settings_account_logo_path,
|
|
params: { logo: upload(content_type: 'application/pdf', bytes: pdf_bytes, filename: 'logo.pdf') }
|
|
|
|
expect(account.reload.logo.attached?).to be(false)
|
|
expect(flash[:alert]).to include('PNG, JPEG, or SVG')
|
|
end
|
|
|
|
it 'rejects files over 2 MB' do
|
|
big = SecureRandom.bytes(Account::LOGO_MAX_BYTES + 1)
|
|
|
|
post settings_account_logo_path, params: { logo: upload(content_type: 'image/png', bytes: big) }
|
|
|
|
expect(account.reload.logo.attached?).to be(false)
|
|
expect(flash[:alert]).to include('under 2 MB')
|
|
end
|
|
|
|
it 'sanitises malicious SVG content before storing' do
|
|
malicious = '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script><rect onload="hax()" /></svg>'
|
|
|
|
post settings_account_logo_path,
|
|
params: { logo: upload(content_type: 'image/svg+xml', bytes: malicious, filename: 'logo.svg') }
|
|
|
|
expect(account.reload.logo.attached?).to be(true)
|
|
stored = account.logo.download
|
|
expect(stored).not_to include('<script')
|
|
expect(stored).not_to include('alert(1)')
|
|
expect(stored).not_to include('onload')
|
|
expect(stored).not_to include('hax()')
|
|
end
|
|
end
|
|
|
|
describe 'DELETE /settings/account_logo' do
|
|
it 'purges the attachment' do
|
|
png_bytes = Rails.public_path.join('favicon-32x32.png').binread
|
|
account.logo.attach(io: StringIO.new(png_bytes), filename: 'logo.png', content_type: 'image/png')
|
|
expect(account.reload.logo.attached?).to be(true)
|
|
|
|
delete settings_account_logo_path
|
|
|
|
expect(account.reload.logo.attached?).to be(false)
|
|
expect(response).to redirect_to(settings_personalization_path)
|
|
end
|
|
end
|
|
end
|