更新

2026-09-03 08:38:17 +08:00
parent 6cd4f1b1db
commit 842990b0e7
1853 changed files with 278406 additions and 361 deletions
@@ -0,0 +1,39 @@
+package app
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestValidateMessagePayload(t *testing.T) {
+	application := &App{config: Config{Environment: "development"}}
+	clientID, content, body, err := application.validateMessagePayload("client-1", 1, map[string]any{"text": " 你好 "})
+	if err != nil {
+		t.Fatalf("expected valid text message: %v", err)
+	}
+	if clientID != "client-1" || content.(map[string]any)["text"] != "你好" || len(body) == 0 {
+		t.Fatalf("message was not normalized: %#v %#v", clientID, content)
+	}
+	if _, _, _, err = application.validateMessagePayload("bad id", 1, map[string]any{"text": "hello"}); err == nil {
+		t.Fatal("client message IDs containing spaces must be rejected")
+	}
+	if _, _, _, err = application.validateMessagePayload("client-2", 1, map[string]any{"text": strings.Repeat("好", maxMessageTextRunes+1)}); err == nil {
+		t.Fatal("oversized text messages must be rejected")
+	}
+	if _, _, _, err = application.validateMessagePayload("client-3", 3, map[string]any{"duration": 61.0, "url": "/uploads/voice.mp3"}); err == nil {
+		t.Fatal("voice messages longer than 60 seconds must be rejected")
+	}
+}
+
+func TestProductionMessageMediaRequiresHTTPS(t *testing.T) {
+	application := &App{config: Config{Environment: "production"}}
+	if _, _, _, err := application.validateMessagePayload("client-1", 2, map[string]any{"url": "http://cdn.example.com/a.jpg"}); err == nil {
+		t.Fatal("production media URLs must use HTTPS")
+	}
+	if _, _, _, err := application.validateMessagePayload("client-2", 2, map[string]any{"url": "https://cdn.example.com/a.jpg"}); err != nil {
+		t.Fatalf("valid HTTPS media URL rejected: %v", err)
+	}
+	if validMessageMediaURL("/uploads/../secret", true) {
+		t.Fatal("local media paths must not allow traversal")
+	}
+}