alexei.dolgolyov
d131ba461c
Lint & Test / test (push) Successful in 20s
Security - Default scripts_management, callbacks_management, links_management, and media_folders_management to False so a leaked token cannot escalate to RCE through admin CRUD endpoints. - TokenSpec + scope hierarchy (read | control | admin); legacy bare-string api_tokens entries promote to admin for back-compat. Management endpoints now require admin scope. - WebSocket subprotocol auth (Sec-WebSocket-Protocol: media-server.token.<T>) preferred over ?token= query so the token no longer lands in URL/history/ Referer; query fallback retained for HA integration back-compat. - Origin allow-list check on the WS endpoint (CSWSH defence). - In-process token-bucket rate limiter: 5/min for failed auths, 10/min for /api/scripts/execute and /api/callbacks/execute. - shell=False subprocess path (shlex.split) + per-parameter regex `pattern` in ScriptParameterConfig to harden shell=true scripts against parameter injection (Windows cmd.exe env-var expansion). - CSP gains form-action, worker-src, manifest-src directives. - Refuse cors_origins=["*"] at startup; strip token=... from uvicorn access logs; validate Gitea release tag against strict SemVer regex. - noopener noreferrer + no-referrer referrerpolicy on every outbound link. - icacls hardening of config.yaml on Windows (current user + SYSTEM + Administrators only); 0600 still enforced on POSIX. - WS volume handler clamps input and never drops the socket on bad messages. Performance - Album-art read in windows_media gated by track key — was decoding the WinRT thumbnail twice per second regardless of track changes. - /api/media/artwork returns content-derived ETag + Cache-Control so the browser sends If-None-Match and gets 304s on track repeats. - Foreground-service ctypes argtypes hoisted to one-time module init (was re-declaring ~14 prototypes per probe). - display_service _static_cache keyed by (edid_hash, ...) tuple with eviction of disappeared monitors — fixes stale capabilities on hot-plug swaps where the new topology has the same monitor count. - Visualizer rAF loop paused on document.hidden, resumed on visible. Reliability / bug fixes - Lifespan rewritten as try/yield/finally so a partial-startup failure cannot orphan background tasks or executors. - _run_callback in routes/media.py keeps a strong task ref (GC-safe) and uses the dedicated callback executor instead of the default pool. - macos_media.set_volume() no longer always returns True. - TrayManager._restart_requested initialised in __init__; set before signalling exit so the main thread observes it correctly. - Missing static_dir now logs a WARNING instead of silent UI disable. UX / accessibility / PWA - manifest.json theme_color and background_color match the Studio Reference base (#0E0D0B); added id and scope for PWA installability. - ARIA on mini-player icon buttons; inner SVGs marked aria-hidden. - OS mediaSession API wired so headset / lockscreen / Bluetooth buttons drive play/pause/next/prev/seek and show track metadata + artwork. Observability - X-Request-ID middleware (accept upstream id if it matches a safe regex, otherwise UUID4); request_id_var added to ContextVars and included in every log line alongside the token label. - Audit log (append-only JSONL) for every script + callback execution, including the on_play/on_pause/etc. event callbacks. Background-thread writer; queue capped; flushed in lifespan teardown. Deployment - proxy_headers + forwarded_allow_ips plumbed through Settings → uvicorn.Config for reverse-proxy installs. - HTTPS support via ssl_certfile + ssl_keyfile (+ optional password); startup refuses to launch with only one of the pair set. - Thumbnail cache moved from project-root .cache to %LOCALAPPDATA%/media-server/cache (Windows) and $XDG_CACHE_HOME/media-server/thumbnails (POSIX). Tests - 35 new tests across auth scopes, rate limiter, browser path traversal (../ NUL UNC absolute), script-param validation incl. regex, Gitea tag whitelist, config atomic write + POSIX perms. 47 passed / 4 skipped.
78 lines
2.9 KiB
Python
78 lines
2.9 KiB
Python
"""Validation rules for script parameters (type coercion, regex pattern)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
from fastapi import HTTPException
|
|
|
|
from media_server.config import ScriptParameterConfig
|
|
from media_server.routes.scripts import _validate_params
|
|
|
|
|
|
def _defs(**kwargs) -> dict[str, ScriptParameterConfig]:
|
|
return {name: ScriptParameterConfig(**spec) for name, spec in kwargs.items()}
|
|
|
|
|
|
def test_unknown_param_rejected():
|
|
with pytest.raises(HTTPException) as ei:
|
|
_validate_params({"x": "1"}, _defs())
|
|
assert ei.value.status_code == 400
|
|
assert "Unknown" in ei.value.detail
|
|
|
|
|
|
def test_missing_required_rejected():
|
|
defs = _defs(name={"type": "string", "required": True})
|
|
with pytest.raises(HTTPException, match="missing"):
|
|
_validate_params({}, defs)
|
|
|
|
|
|
def test_integer_coercion_and_bounds():
|
|
defs = _defs(volume={"type": "integer", "min": 0, "max": 100})
|
|
out = _validate_params({"volume": "42"}, defs)
|
|
assert out == {"SCRIPT_PARAM_VOLUME": "42"}
|
|
|
|
with pytest.raises(HTTPException, match="<="):
|
|
_validate_params({"volume": 200}, defs)
|
|
with pytest.raises(HTTPException, match=">="):
|
|
_validate_params({"volume": -1}, defs)
|
|
with pytest.raises(HTTPException, match="integer"):
|
|
_validate_params({"volume": "not-a-number"}, defs)
|
|
|
|
|
|
def test_boolean_coercion():
|
|
defs = _defs(flag={"type": "boolean"})
|
|
assert _validate_params({"flag": "true"}, defs) == {"SCRIPT_PARAM_FLAG": "True"}
|
|
assert _validate_params({"flag": "no"}, defs) == {"SCRIPT_PARAM_FLAG": "False"}
|
|
with pytest.raises(HTTPException, match="boolean"):
|
|
_validate_params({"flag": "maybe"}, defs)
|
|
|
|
|
|
def test_select_rejects_non_option():
|
|
defs = _defs(mode={"type": "select", "options": ["a", "b", "c"]})
|
|
assert _validate_params({"mode": "a"}, defs) == {"SCRIPT_PARAM_MODE": "a"}
|
|
with pytest.raises(HTTPException, match="must be one of"):
|
|
_validate_params({"mode": "z"}, defs)
|
|
|
|
|
|
def test_pattern_enforced_on_string():
|
|
"""Regex pattern is the defence against shell metachars in shell=true scripts."""
|
|
defs = _defs(host={"type": "string", "pattern": r"^[a-z0-9.\-]+$"})
|
|
assert _validate_params({"host": "example.com"}, defs) == {"SCRIPT_PARAM_HOST": "example.com"}
|
|
with pytest.raises(HTTPException, match="pattern"):
|
|
_validate_params({"host": "evil & calc.exe"}, defs)
|
|
with pytest.raises(HTTPException, match="pattern"):
|
|
_validate_params({"host": "$(rm -rf /)"}, defs)
|
|
|
|
|
|
def test_pattern_can_disallow_empty():
|
|
defs = _defs(host={"type": "string", "pattern": r"^[a-z]+$"})
|
|
with pytest.raises(HTTPException, match="pattern"):
|
|
_validate_params({"host": ""}, defs)
|
|
|
|
|
|
def test_invalid_pattern_in_config_fails_closed():
|
|
defs = _defs(host={"type": "string", "pattern": r"["}) # unmatched bracket
|
|
with pytest.raises(HTTPException) as ei:
|
|
_validate_params({"host": "x"}, defs)
|
|
assert ei.value.status_code == 500
|