geng

app/tests/test_diagnosis_media_thumbnail_visual.py

@@ -7,7 +7,7 @@ os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
 import pytest
 from PySide6.QtCore import QBuffer, QByteArray, QIODevice, QObject, QSize, Signal
 from PySide6.QtGui import QColor, QImage
-from PySide6.QtNetwork import QNetworkReply
+from PySide6.QtNetwork import QNetworkReply, QNetworkRequest
 from PySide6.QtWidgets import QApplication, QPushButton, QWidget
 
 from doctor_workstation.ui.diagnosis_drawer import (
@@ -34,6 +34,7 @@ def _png_bytes(width: int, height: int, color: str = "#0F766E") -> bytes:
 
 class _FakeReply(QObject):
     finished = Signal()
+    downloadProgress = Signal(int, int)
 
     def __init__(
         self,
@@ -45,6 +46,7 @@ class _FakeReply(QObject):
         self.payload = payload
         self.network_error = error
         self.aborted = False
+        self.read_all_calls = 0
 
     def abort(self) -> None:
         self.aborted = True
@@ -53,6 +55,7 @@ class _FakeReply(QObject):
         return self.network_error
 
     def readAll(self) -> QByteArray:  # noqa: N802 - mirrors QNetworkReply
+        self.read_all_calls += 1
         return QByteArray(self.payload)
 
 
@@ -61,6 +64,7 @@ class _FakeManager(QObject):
         super().__init__(parent)
         self.responses: list[tuple[bytes, QNetworkReply.NetworkError]] = []
         self.requests: list[str] = []
+        self.request_objects: list[object] = []
         self.replies: list[_FakeReply] = []
 
     def queue(
@@ -73,6 +77,7 @@ class _FakeManager(QObject):
     def get(self, request: object) -> _FakeReply:
         payload, error = self.responses.pop(0)
         self.requests.append(request.url().toString())
+        self.request_objects.append(request)
         reply = _FakeReply(payload, error, self)
         self.replies.append(reply)
         return reply
@@ -174,6 +179,45 @@ def test_remote_image_uses_text_only_after_request_or_decode_failure(
     assert application.thread() == button.thread()
 
 
+def test_remote_image_enforces_same_origin_redirects_and_aborts_oversize_download(
+    application: QApplication,
+) -> None:
+    owner = _RenderOwner(5)
+    button = _RemoteImageButton(
+        "",
+        render_owner=owner,
+        owner_generation=5,
+        maximum_size=QSize(64, 64),
+        fallback_text="image unavailable",
+        cover=True,
+        object_name="DiagnosisTongueThumb",
+        parent=owner,
+    )
+    button._manager.deleteLater()
+    manager = _FakeManager(button)
+    button._manager = manager
+    manager.queue(b"must-not-be-read")
+
+    button.load_url("https://media.example.invalid/oversize.png")
+    request = manager.request_objects[-1]
+    assert request.attribute(QNetworkRequest.Attribute.RedirectPolicyAttribute) == (
+        QNetworkRequest.RedirectPolicy.SameOriginRedirectPolicy
+    )
+
+    reply = manager.replies[-1]
+    reply.downloadProgress.emit(button._MAX_IMAGE_BYTES, -1)
+    assert reply.aborted is False
+    reply.downloadProgress.emit(button._MAX_IMAGE_BYTES + 1, -1)
+    assert reply.aborted is True
+    assert reply.property("diagnosisImageOversize") is True
+
+    reply.finished.emit()
+    assert reply.read_all_calls == 0
+    assert button.property("loadState") == "failed"
+    assert button.text() == "image unavailable"
+    assert application.thread() == button.thread()
+
+
 def test_notes_render_cover_thumbnail_and_keep_safe_open_and_single_delete(
     application: QApplication,
     monkeypatch: pytest.MonkeyPatch,