25 lines
1.0 KiB
TypeScript
25 lines
1.0 KiB
TypeScript
import path from "node:path";
|
|
import { describe, expect, it } from "vitest";
|
|
import { sendVoiceMessageDiscord } from "./send.js";
|
|
|
|
describe("sendVoiceMessageDiscord - media hardening", () => {
|
|
it("rejects local paths outside allowed media roots (prevents local file exfiltration)", async () => {
|
|
const candidate = path.join(process.cwd(), "package.json");
|
|
await expect(sendVoiceMessageDiscord("channel:123", candidate)).rejects.toThrow(
|
|
/Local media path is not under an allowed directory/,
|
|
);
|
|
});
|
|
|
|
it("blocks SSRF targets when given a private-network URL", async () => {
|
|
await expect(
|
|
sendVoiceMessageDiscord("channel:123", "http://127.0.0.1/voice.ogg"),
|
|
).rejects.toThrow(/Failed to fetch media|Blocked/);
|
|
});
|
|
|
|
it("does not allow non-http URL schemes to reach ffmpeg/ffprobe", async () => {
|
|
await expect(
|
|
sendVoiceMessageDiscord("channel:123", "rtsp://example.com/voice.ogg"),
|
|
).rejects.toThrow(/Local media path is not under an allowed directory|ENOENT|no such file/i);
|
|
});
|
|
});
|