buff and test sanitization

Author: drduh

handlers/clear.go

@@ -13,10 +13,8 @@ func Clear(app *config.App) http.HandlerFunc {
 		if req == nil {
 			return
 		}
-
 		app.ClearStorage()
 		app.Log.Info("storage cleared", "user", req)
-
 		toRoot(w, r, app.Root)
 	}
 }

handlers/upload.go

@@ -78,7 +78,7 @@ func Upload(app *config.App) http.HandlerFunc {
 				}
 
 				filename := storage.SanitizeName(fileHeader.Filename,
-					app.MaxSizeName, app.AllowedSpecialChars)
+					app.MaxSizeName, app.FilenameExtraChars)
 				f := &storage.File{
 					Name: filename,
 					Data: buf.Bytes(),

settings/config.go

@@ -185,8 +185,8 @@ type Default struct {
 // Content represents limits on content sharing.
 type Limit struct {
 
-	// Special characters allowed in file names
-	AllowedSpecialChars string `json:"specialChars,omitempty"`
+	// Extra characters allowed in file names
+	FilenameExtraChars string `json:"filenameChars,omitempty"`
 
 	// Maximum number of allowed downloads
 	MaxDownloads int `json:"maxDownloads,omitempty"`

settings/defaultSettings.json

@@ -74,14 +74,14 @@
   },
   "limit": {
     "expiryTicker":  "30s",
+    "filenameChars": "_.-",
     "maxDownloads":  100,
     "maxDuration":   "192h",
     "maxSizeMsg":    128,
-    "maxSizeName":   60,
+    "maxSizeName":   64,
     "maxSizeWall":   1280,
     "maxSizeFileMb": 256,
-    "reqsPerMinute": 30,
-    "specialChars":  "_.-"
+    "reqsPerMinute": 30
   },
   "paths": {
     "assets":      "/assets/",

storage/sanitize.go

@@ -6,25 +6,26 @@ import (
 	"unicode"
 )
 
+const defaultName = "default"
+
 // SanitizeName validates strings for use as filename.
-func SanitizeName(input string, maxLength int, specialChars string) string {
+func SanitizeName(input string, maxLength int, extraChars string) string {
 	f := filepath.Base(input)
-	f = removeInvalidChars(f, specialChars)
-	f = truncateName(f, maxLength)
-	return f
-}
-
-// isAllowedChar returns true if a character is allowed.
-func isAllowedChar(r rune, allowed string) bool {
-	return strings.ContainsRune(allowed, r)
+	f = removeInvalidChars(f, extraChars)
+	ext := filepath.Ext(f)
+	base := strings.TrimSuffix(f, ext)
+	if base == "" {
+		base = defaultName
+	}
+	return truncateName(base, ext, maxLength)
 }
 
 // removeInvalidChars removes all invalid characters.
 func removeInvalidChars(filename string, allowed string) string {
 	var result strings.Builder
 	for _, char := range filename {
-		if unicode.IsLetter(char) ||
-			unicode.IsDigit(char) ||
+		if unicode.IsDigit(char) ||
+			unicode.IsLetter(char) ||
 			isAllowedChar(char, allowed) {
 			result.WriteRune(char)
 		}
@@ -33,16 +34,24 @@ func removeInvalidChars(filename string, allowed string) string {
 }
 
 // truncateName trims a filename string to max size,
-// preserving the original file extension.
-func truncateName(filename string, length int) string {
-	if len(filename) <= length {
-		return filename
+// preserving reasonably-sized original file extensions.
+func truncateName(base string, ext string, maxLength int) string {
+	const maxExtensionLength = 5
+	if len(ext) > maxExtensionLength {
+		ext = ext[:maxExtensionLength]
 	}
-	ext := filepath.Ext(filename)
-	base := strings.TrimSuffix(filename, ext)
-	maxBaseLength := length - len(ext)
-	if len(base) > maxBaseLength {
-		base = base[:maxBaseLength]
+	totalLength := len(base) + len(ext)
+	if totalLength <= maxLength {
+		return base + ext
 	}
-	return base + ext
+	allowedBaseLength := maxLength - len(ext)
+	if allowedBaseLength > 0 {
+		return base[:allowedBaseLength] + ext
+	}
+	return ext[:maxLength]
+}
+
+// isAllowedChar returns true if a character is allowed.
+func isAllowedChar(r rune, allowed string) bool {
+	return strings.ContainsRune(allowed, r)
 }

storage/sanitize_test.go

@@ -0,0 +1,89 @@
+package storage
+
+import "testing"
+
+const extraChars = "_.-"
+
+// TestRemoveInvalidChars validates invalid characters
+// are removed from filename strings.
+func TestRemoveInvalidChars(t *testing.T) {
+	tests := []struct {
+		input string
+		allow string
+		want  string
+	}{
+		{"filename.txt", extraChars, "filename.txt"},
+		{"file@name!.txt", extraChars, "filename.txt"},
+		{"_file-name.txt", extraChars, "_file-name.txt"},
+		{"123-abc_ABC.txt", extraChars, "123-abc_ABC.txt"},
+		{"chars@#$name.txt", extraChars, "charsname.txt"},
+		{"afile", extraChars, "afile"},
+		{".....", extraChars, "....."},
+		{"!@#$%^&()", extraChars, ""},
+		{"", extraChars, ""},
+	}
+	for _, test := range tests {
+		result := removeInvalidChars(test.input, test.allow)
+		if result != test.want {
+			t.Fatalf("name: '%s' ('%s' allowed): '%s'; want: '%s'",
+				test.input, test.allow, result, test.want)
+		}
+	}
+}
+
+// TestTruncateName validates filenames are truncated
+// to the desired length.
+func TestTruncateName(t *testing.T) {
+	tests := []struct {
+		base   string
+		ext    string
+		length int
+		want   string
+	}{
+		{"shrt", ".exceedinglylongext", 10, "shrt.exce"},
+		{"base", ".longextension", 12, "base.long"},
+		{"exactfit", ".jpeg", 13, "exactfit.jpeg"},
+		{"longfilename", ".txt", 10, "longfi.txt"},
+		{"truncatebase", ".png", 8, "trun.png"},
+		{"onlybase", ".toolong", 8, "onl.tool"},
+		{"short", ".dat", 9, "short.dat"},
+		{"example", "", 5, "examp"},
+		{"", ".zip", 5, ".zip"},
+		{"", "", 0, ""},
+	}
+	for _, test := range tests {
+		result := truncateName(test.base, test.ext, test.length)
+		if result != test.want {
+			t.Fatalf("base: '%s', ext: '%s' (%d); got: '%s', want: '%s'",
+				test.base, test.ext, test.length, result, test.want)
+		}
+	}
+}
+
+// TestSanitizeName validates filenames do not exceed
+// length nor contain disallowed special characters.
+func TestSanitizeName(t *testing.T) {
+	tests := []struct {
+		input      string
+		maxLength  int
+		extraChars string
+		want       string
+	}{
+		{"my@invalid#name?.txt", 20, extraChars, "myinvalidname.txt"},
+		{"averylongfilename.png", 15, extraChars, "averylongfi.png"},
+		{"my.file.name.txt", 20, extraChars, "my.file.name.txt"},
+		{".hiddenfile", 15, extraChars, defaultName + ".hidd"},
+		{"myfilename.png", 20, extraChars, "myfilename.png"},
+		{"/path/to/file.txt", 20, extraChars, "file.txt"},
+		{"myfilenames", 10, extraChars, "myfilename"},
+		{".@#$%^&*.png", 15, extraChars, "..png"},
+		{"@#$%^&*", 10, extraChars, defaultName},
+	}
+	for _, test := range tests {
+		result := SanitizeName(test.input, test.maxLength, test.extraChars)
+		if result != test.want {
+			t.Fatalf("name: '%s', length: %d, special: '%s', got: '%s', want: '%s'",
+				test.input, test.maxLength, test.extraChars, result, test.want)
+		}
+	}
+}