--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
tests/backend/test_lxmf_image_magic.py bce42bcdce0e7d2c6d78228e864a4cd1d974cc82 (bce42bcd) Text, 1.17 KB
T8b949e# SPDX-License-Identifier: 0BSD
T8b949e"""LXMF attachment image serving must trust magic bytes, not declared type."""
Tff7b72import T7ee787base64
Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787backendT7ee787.T7ee787sticker_utils Tff7b72import Te6edf3detect_image_format_from_magic
Te6edf3_PNG Tff7b72= Ta5d6ffbTa5d6ff"Tffea00\x89Ta5d6ffPNGTffea00\rTffea00\nTffea00\x1aTffea00\nTa5d6ff" Tff7b72+ Ta5d6ffbTa5d6ff"Tffea00\x00Ta5d6ff" Tff7b72* T79c0ff16
Te6edf3_ALLOWED Tff7b72= Tb4b4b4{Ta5d6ff"Ta5d6ffpngTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffjpegTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffjpgTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffgifTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffwebpTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffbmpTa5d6ff"Tb4b4b4}
Tff7b72def Td2a8ff_resolve_served_image_typeTb4b4b4(Te6edf3image_dataTb4b4b4: Tffa657bytesTb4b4b4) Tff7b72-Tff7b72> Tffa657str Tff7b72| Tff7b72NoneTb4b4b4:
Te6edf3detected Tff7b72= Te6edf3detect_image_format_from_magicTb4b4b4(Te6edf3image_dataTb4b4b4)
Tff7b72if Te6edf3detected Tff7b72is Tff7b72None Tff7b72or Te6edf3detected Tff7b72not Tff7b72in Te6edf3_ALLOWEDTb4b4b4:
Tff7b72return Tff7b72None
Tff7b72return Ta5d6ff"Ta5d6ffjpegTa5d6ff" Tff7b72if Te6edf3detected Tff7b72== Ta5d6ff"Ta5d6ffjpegTa5d6ff" Tff7b72else Te6edf3detected
Tff7b72def Td2a8fftest_lxmf_image_serve_uses_png_magic_not_declared_htmlTb4b4b4(Tb4b4b4)Tb4b4b4:
Tff7b72assert Te6edf3_resolve_served_image_typeTb4b4b4(Te6edf3_PNGTb4b4b4) Tff7b72== Ta5d6ff"Ta5d6ffpngTa5d6ff"
Tff7b72assert Te6edf3_resolve_served_image_typeTb4b4b4(Ta5d6ffbTa5d6ff"Ta5d6ff<html><script>x</script>Ta5d6ff"Tb4b4b4) Tff7b72is Tff7b72None
Tff7b72assert Te6edf3_resolve_served_image_typeTb4b4b4(Ta5d6ffbTa5d6ff"Ta5d6ff"Tb4b4b4) Tff7b72is Tff7b72None
Tff7b72def Td2a8fftest_lxmf_image_send_rejects_non_image_payloadTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3raw Tff7b72= Ta5d6ffbTa5d6ff"Ta5d6ffnot-an-imageTa5d6ff"
Te6edf3detected Tff7b72= Te6edf3detect_image_format_from_magicTb4b4b4(Te6edf3rawTb4b4b4)
Tff7b72assert Te6edf3detected Tff7b72is Tff7b72None Tff7b72or Te6edf3detected Tff7b72in Tb4b4b4{Ta5d6ff"Ta5d6ffwebmTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6fftgsTa5d6ff"Tb4b4b4}
Tff7b72def Td2a8fftest_png_bytes_survive_b64_roundtrip_detectionTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3b64 Tff7b72= Te6edf3base64Tff7b72.Td2a8ffb64encodeTb4b4b4(Te6edf3_PNGTb4b4b4)Tff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffasciiTa5d6ff"Tb4b4b4)
Tff7b72assert Te6edf3detect_image_format_from_magicTb4b4b4(Te6edf3base64Tff7b72.Td2a8ffb64decodeTb4b4b4(Te6edf3b64Tb4b4b4)Tb4b4b4) Tff7b72== Ta5d6ff"Ta5d6ffpngTa5d6ff"
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────