jellyfin/jellyfin
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin.git synced 2026-09-02 21:03:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix formatting and test

Browse Source
This commit is contained in:
Shadowghost
2026-08-30 22:29:36 +02:00
parent 420d44f638
commit 11adad0e67
3 changed files with 59 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MediaBrowser.Controller/IO/FileSystemHelper.cs
+8 -3
View File
@@ -193,8 +193,13 @@ public static class FileSystemHelper
var fullParentPath = Path.TrimEndingDirectorySeparator(Path.GetFullPath(parentPath));
// Catches the remaining relative names, "." and "..", which are valid single segments.
return string.Equals(Path.GetDirectoryName(fullPath), fullParentPath, StringComparison.Ordinal)
? fullPath
: null;
if (!string.Equals(Path.GetDirectoryName(fullPath), fullParentPath, StringComparison.Ordinal))
{
return null;
}
// Windows strips trailing dots and spaces, so a name like "..." resolves to the parent directory itself
// and a name like "Movies." to a different child. Reject anything normalization did not leave intact.
return string.Equals(Path.GetFileName(fullPath), name, StringComparison.Ordinal) ? fullPath : null;
}
}
src/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs
+32 -32
View File
@@ -83,48 +83,48 @@ internal static class SvgSecurityValidator
switch (reader.NodeType)
{
case XmlNodeType.DocumentType:
{
var subset = reader.Value;
if (!string.IsNullOrEmpty(subset)
&& (subset.Contains("SYSTEM", StringComparison.OrdinalIgnoreCase)
|| subset.Contains("PUBLIC", StringComparison.OrdinalIgnoreCase)))
{
return "The document declares an external DTD entity";
var subset = reader.Value;
if (!string.IsNullOrEmpty(subset)
&& (subset.Contains("SYSTEM", StringComparison.OrdinalIgnoreCase)
|| subset.Contains("PUBLIC", StringComparison.OrdinalIgnoreCase)))
{
return "The document declares an external DTD entity";
}
break;
}
break;
}
case XmlNodeType.Element when reader.HasAttributes:
{
for (var i = 0; i < reader.AttributeCount; i++)
{
reader.MoveToAttribute(i);
var isHref = reader.LocalName.Equals("href", StringComparison.OrdinalIgnoreCase);
var reason = isHref
? ValidateReference(reader.Value, depth, "href")
: ValidateCss(reader.Value, depth);
for (var i = 0; i < reader.AttributeCount; i++)
{
reader.MoveToAttribute(i);
var isHref = reader.LocalName.Equals("href", StringComparison.OrdinalIgnoreCase);
var reason = isHref
? ValidateReference(reader.Value, depth, "href")
: ValidateCss(reader.Value, depth);
if (reason is not null)
{
return reason;
}
}
reader.MoveToElement();
break;
}
case XmlNodeType.Text:
case XmlNodeType.CDATA:
{
var reason = ValidateCss(reader.Value, depth);
if (reason is not null)
{
return reason;
}
break;
}
reader.MoveToElement();
break;
}
case XmlNodeType.Text:
case XmlNodeType.CDATA:
{
var reason = ValidateCss(reader.Value, depth);
if (reason is not null)
{
return reason;
}
break;
}
}
}
tests/Jellyfin.Controller.Tests/IO/FileSystemHelperTests.cs
+19 -1
View File
@@ -13,7 +13,6 @@ public class FileSystemHelperTests
[InlineData("Movies")]
[InlineData("My Movies")]
[InlineData("..2")]
[InlineData("...")]
[InlineData("a.b")]
public void GetChildPath_ValidName_ReturnsPathInsideParent(string name)
{
@@ -50,6 +49,25 @@ public class FileSystemHelperTests
Assert.True(path is null || string.Equals(Path.GetDirectoryName(path), _parentPath, StringComparison.Ordinal));
}
[Theory]
[InlineData("...")]
[InlineData("Movies.")]
[InlineData("Movies ")]
public void GetChildPath_TrailingDotOrSpace_RejectedOnWindows(string name)
{
var path = FileSystemHelper.GetChildPath(_parentPath, name);
if (OperatingSystem.IsWindows())
{
// Windows trims trailing dots and spaces, so the name would resolve to the parent or to a different child.
Assert.Null(path);
}
else
{
Assert.Equal(Path.Combine(_parentPath, name), path);
}
}
[Fact]
public void GetChildPath_ParentWithTrailingSeparator_ReturnsPathInsideParent()
{