tauri-app: 8a review fixes
- fetchBlob cache keyed by (did, cid), not just cid. Security: future per-DID access control on getBlob would otherwise leak the first responder's bytes to subsequent viewers. - EmbedImage: pass did to releaseBlob, release previous cid on cid change (no leaked URLs). - ComposeBox: releaseBlob called with both did and cid. - pds-server: rename test get_blob_after_upload_with_different_did -> get_blob_returns_404_for_cross_did_cid_lookup. The docstring was misleading — the test only verifies the (did,cid) PK on the PDS row, not auth. The renamed name matches what the test actually checks. - vitest: update releaseBlob call sites to the new (did, cid) signature.
This commit is contained in:
tomdebone
@@ -402,3 +402,186 @@ async fn get_blob_returns_detected_mime_type() {
|
||||
"getBlob should serve the stored mime type, not the octet-stream default"
|
||||
);
|
||||
}
|
||||
|
||||
// -- Phase 8: full upload+get round-trip + cross-DID security ----------------
|
||||
|
||||
/// End-to-end round-trip:
|
||||
/// 1. User A uploads a small JPEG-shaped payload.
|
||||
/// 2. The `com.atproto.uploadBlob` response carries the correct
|
||||
/// CID, size, and MIME type.
|
||||
/// 3. `com.atproto.sync.getBlob?did=A&cid=...` returns the same
|
||||
/// bytes with the stored MIME type.
|
||||
///
|
||||
/// This is the test the Tauri `pickAndUploadImage` /
|
||||
/// `EmbedImage` flow depends on — it pins the wire shape end to
|
||||
/// end so changes to either side show up here before they reach
|
||||
/// the desktop client.
|
||||
#[tokio::test]
|
||||
async fn upload_then_get_blob_round_trip() {
|
||||
if !wait_for_pds().await {
|
||||
eprintln!("pds not running, skipping");
|
||||
return;
|
||||
}
|
||||
let (c, did, jwt) = fresh_user("rtrip").await;
|
||||
seed_any_record(&c, &did, &jwt).await;
|
||||
|
||||
// Use a tiny JPEG-shaped payload (SOI/EOI markers) so the
|
||||
// magic-byte sniffer classifies it as `image/jpeg` server-side
|
||||
// if the upload header is stripped — we always send
|
||||
// `Content-Type: image/jpeg` here, so it doesn't matter, but
|
||||
// it's the closest "real image" we can fit in a few bytes.
|
||||
let payload: Vec<u8> = vec![0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10];
|
||||
let expected_cid = blob_cid(&payload).to_string();
|
||||
|
||||
let up: Value = c
|
||||
.post(format!("{}/xrpc/com.atproto.uploadBlob", PDS_URL))
|
||||
.bearer_auth(&jwt)
|
||||
.header("Content-Type", "image/jpeg")
|
||||
.body(payload.clone())
|
||||
.send()
|
||||
.await
|
||||
.unwrap()
|
||||
.json()
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
let returned_cid = up["blob"]["ref"]["$link"].as_str().unwrap();
|
||||
let returned_size = up["blob"]["size"].as_u64().unwrap();
|
||||
let returned_mime = up["blob"]["mimeType"].as_str().unwrap();
|
||||
assert_eq!(returned_cid, expected_cid, "upload CID mismatch");
|
||||
assert_eq!(returned_size, payload.len() as u64);
|
||||
assert_eq!(returned_mime, "image/jpeg");
|
||||
|
||||
let get = c
|
||||
.get(format!(
|
||||
"{}/xrpc/com.atproto.sync.getBlob?did={}&cid={}",
|
||||
PDS_URL, did, returned_cid
|
||||
))
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(get.status().as_u16(), 200);
|
||||
let ct = get
|
||||
.headers()
|
||||
.get("content-type")
|
||||
.and_then(|v| v.to_str().ok())
|
||||
.unwrap_or("")
|
||||
.to_string();
|
||||
let bytes = get.bytes().await.unwrap();
|
||||
assert_eq!(bytes.as_ref(), payload.as_slice());
|
||||
assert_eq!(ct, "image/jpeg");
|
||||
}
|
||||
|
||||
/// Cross-DID isolation check.
|
||||
///
|
||||
/// Setup:
|
||||
/// * User A uploads a blob (gets a row at `(did_A, cid)` in
|
||||
/// `repo_blocks`).
|
||||
/// * User B (an unrelated account) uploads a different blob
|
||||
/// (gets a row at `(did_B, cid_B)`).
|
||||
///
|
||||
/// Security property under test: User B must not be able to read
|
||||
/// User A's blob by requesting `did=A&cid=cid_A`. The PDS keys
|
||||
/// `repo_blocks` by `(did, cid)`, so the row is simply not visible
|
||||
/// to User B's query — the endpoint should respond with a
|
||||
/// `RepoNotFound` (because User A has rows but B's request with
|
||||
/// `did=B` resolves to B's own repo) or `BlobNotFound` (if A had
|
||||
/// zero rows), both of which are 400-class errors. The exact code
|
||||
/// depends on which DID we send: sending `did=A` returns the blob
|
||||
/// (the API is unauthenticated by spec), sending `did=B` against
|
||||
/// A's CID returns 400. The test verifies the latter — that
|
||||
/// *cross-DID CID guessing* doesn't work.
|
||||
#[tokio::test]
|
||||
async fn get_blob_returns_404_for_cross_did_cid_lookup() {
|
||||
if !wait_for_pds().await {
|
||||
eprintln!("pds not running, skipping");
|
||||
return;
|
||||
}
|
||||
|
||||
// User A: uploads one blob.
|
||||
let (ca, did_a, jwt_a) = fresh_user("isoa").await;
|
||||
seed_any_record(&ca, &did_a, &jwt_a).await;
|
||||
let payload_a: Vec<u8> = b"alice's private blob \xff\xd8\xff\xd9".to_vec();
|
||||
let up_a: Value = ca
|
||||
.post(format!("{}/xrpc/com.atproto.uploadBlob", PDS_URL))
|
||||
.bearer_auth(&jwt_a)
|
||||
.header("Content-Type", "image/jpeg")
|
||||
.body(payload_a.clone())
|
||||
.send()
|
||||
.await
|
||||
.unwrap()
|
||||
.json()
|
||||
.await
|
||||
.unwrap();
|
||||
let cid_a = up_a["blob"]["ref"]["$link"].as_str().unwrap().to_string();
|
||||
|
||||
// User B: completely separate account. We only need B to have
|
||||
// at least one row so the `repo_blocks` "is the repo empty?"
|
||||
// gate doesn't trip on B's behalf — but the gate checks the
|
||||
// DID in the query string, so as long as B exists B's DID
|
||||
// passes its own gate. We seed a post anyway to mirror the
|
||||
// happy-path precondition.
|
||||
let (cb, did_b, jwt_b) = fresh_user("isob").await;
|
||||
seed_any_record(&cb, &did_b, &jwt_b).await;
|
||||
|
||||
// 1. User B's own getBlob request for their DID works (sanity).
|
||||
let own = cb
|
||||
.get(format!(
|
||||
"{}/xrpc/com.atproto.sync.getBlob?did={}&cid=not-a-cid",
|
||||
PDS_URL, did_b
|
||||
))
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
// The CID is invalid, but the `did` gate must pass because B
|
||||
// has rows. We expect a 4xx, not a 5xx.
|
||||
assert!(
|
||||
(400..500).contains(&own.status().as_u16()),
|
||||
"B's own bad-cid request should return 4xx, got {}",
|
||||
own.status()
|
||||
);
|
||||
|
||||
// 2. User B cannot read User A's blob by sending `did=B&cid=cid_A`.
|
||||
// `(did_B, cid_A)` is not a row in `repo_blocks`, so the lookup
|
||||
// returns no bytes and the PDS responds with `BlobNotFound`.
|
||||
let cross = cb
|
||||
.get(format!(
|
||||
"{}/xrpc/com.atproto.sync.getBlob?did={}&cid={}",
|
||||
PDS_URL, did_b, cid_a
|
||||
))
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(
|
||||
!cross.status().is_success(),
|
||||
"cross-DID getBlob must NOT succeed; got {}",
|
||||
cross.status()
|
||||
);
|
||||
let cross_body: Value = cross.json().await.unwrap();
|
||||
// The exact error is `BlobNotFound` (because `(did_B, cid_A)`
|
||||
// is absent from `repo_blocks`). We accept any 4xx with a
|
||||
// JSON envelope so the test isn't tightly coupled to the
|
||||
// error code — but we log it for visibility.
|
||||
let cross_err = cross_body["error"].as_str().unwrap_or("");
|
||||
assert!(
|
||||
cross_err == "BlobNotFound" || cross_err == "InvalidRequest",
|
||||
"expected BlobNotFound/InvalidRequest for cross-DID access, got {cross_err}"
|
||||
);
|
||||
|
||||
// 3. Sanity check: User A's own getBlob for their own CID still
|
||||
// returns the bytes (the test would be misleading if we
|
||||
// accidentally broke the happy path).
|
||||
let alice_own = ca
|
||||
.get(format!(
|
||||
"{}/xrpc/com.atproto.sync.getBlob?did={}&cid={}",
|
||||
PDS_URL, did_a, cid_a
|
||||
))
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(alice_own.status().as_u16(), 200);
|
||||
assert_eq!(
|
||||
alice_own.bytes().await.unwrap().as_ref(),
|
||||
payload_a.as_slice()
|
||||
);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user