Files
bd5adc61c8 feat(bitrix24): imbot.v2 migration, 2-way media, openline sender-tag echo, and hardening (#1236)
* refactor(bitrix24): rename "Path B" framing to maintainer-specified naming [B24:2794]

Per maintainer hard rule #10 (no generic "Path A/B" framing) from PR #1061
review. The Bitrix24 MCP auto-onboard flow is Bitrix-specific glue
("Bitrix24 OAuth -> existing mcp_user_credentials bridge"), NOT a generic
MCP architecture pattern.

Naming convention applied consistently:
- First mention per file: full "Bitrix24 OAuth -> existing
  mcp_user_credentials bridge" (matches maintainer comment verbatim).
- Subsequent mentions in same file: shortened "mcp_user_credentials bridge".
- Test/log context referencing literal endpoint /api/auto-onboard: keep
  "auto-onboard" reference (it's the actual API endpoint name).

Changes are documentation-only:
- Rename in code comments + test descriptions + plan docs.
- Clarify framing in mcp_client.go + provisioner.go doc comments to
  emphasize Bitrix-specific glue (not generic MCP infra).
- Reuse existing mcp_user_credentials table + MCPServerStore methods
  (no schema / store / abstraction change).

Files:
- cmd/gateway.go (factory registration doc)
- internal/channels/bitrix24/{channel,factory,mcp_client,provisioner}.go
- internal/channels/bitrix24/{mcp_client,provisioner}_test.go
- plan/goclaw-mcp-integration.md (21 occurrences)

Verified: go build + MCP-related tests pass (TestProvision*,
TestInitMCPProvisioner*, TestMCPClient*).

Phase 1 of Path C execution per
plans/reports/decision-log-260519-1555-bitrix24-pr-fork-decision.md.

* fix: confine outbound media paths to agent workspace [B24:2794]

Tool MEDIA:<path> output reached channel file-upload sinks (Bitrix
imbot.v2.File.upload, Telegram sendDocument, etc.) verbatim via
parseMediaResult, with no workspace-boundary check. A malicious or buggy
tool emitting MEDIA:/etc/passwd could exfiltrate arbitrary files to chat.

Extract the EvalSymlinks+Rel containment from extractMediaFromContent into
a shared confineToWorkspace helper and apply it at the parseMediaResult
sink in processToolResult. Fixing at the source/egress boundary protects
every channel at once rather than per-channel. Paths that escape the
workspace are dropped and logged (security.media_path_rejected).

Add TestConfineToWorkspace (boundary unit) and
TestParseMediaResultConfinedToWorkspace (sink regression for H2).

* feat(bitrix24): support inbound + outbound media via imbot.v2 File API [B24:2794]

Bitrix24 channel was text-only; attachments were parsed but dropped.
- Inbound: download chat files via imbot.v2.File.download (one-time URL),
  forward to the agent with MIME preserved (internal/channels/bitrix24/download.go).
- Outbound: upload agent media to the chat via imbot.v2.File.upload
  (internal/channels/bitrix24/send_media.go).
- Add BaseChannel.HandleMessageMedia to preserve MIME/filename through the bus.
- Per-channel media_max_mb cap (default 20) applies to both directions.

Tests: 92 pass (internal/channels/bitrix24 + internal/channels), go vet clean (PG + sqliteonly).

* refactor(bitrix24): migrate messaging/bot-list/unregister to imbot v2 API [B24:2794]

Move outbound REST calls to the imbot v2 family (keeps register on v1):
- imbot.message.add -> imbot.v2.Chat.Message.send (fields.message shape, live-verified)
- imbot.bot.list (+ legacy imbot.list fallback) -> imbot.v2.Bot.list; add botListRows
  to normalize the v2 {bots:[...]} envelope, legacy array, and id-keyed map forms
- imbot.unregister -> imbot.v2.Bot.unregister

Bot registration stays on v1 imbot.register: v2 imbot.v2.Bot.register changes the
event-delivery model (per-event handler URLs -> eventMode), which would require
rewriting the inbound event parser. No user-facing behavior change.

Tests: bitrix24 package green; go vet ./... clean.

* feat(bitrix24): route whisper via v1 SKIP_CONNECTOR + add v2 replyId [B24:2794]

Bot was leaking HiddenMessage (whisper) replies to the external Zalo
connector because every outbound call went through imbot.v2.Chat.Message.send,
which has no equivalent of the v1 SKIP_CONNECTOR flag. Branch the outbound
path on inbound visibility:

  whisper → imbot.message.add + SKIP_CONNECTOR=Y  (v1, send_v1.go)
  public  → imbot.v2.Chat.Message.send + fields.replyId  (v2, send_v2.go)

Pipeline:
  events.go        parse data[PARAMS][PARAMS][COMPONENT_ID]=HiddenMessage
                   into EventParams.IsHiddenMessage (form + JSON variants)
  handle.go        set bitrix_visibility on InboundMessage.Metadata
  consumer         forward visibility + message_id into OutboundMessage
  send.go          resolveSendOptions + sendChunk dispatcher +
                   shared callWithRateLimitRetry helper
  metadata_keys.go single source of truth for the keys + values

Defaults preserve pre-refactor behaviour: callers that don't populate
bitrix_visibility still go through v2 public, and replyId is omitted
unless a numeric bitrix_message_id arrives in metadata.

Tests:
  TestParseEvent_FormURLEncoded_IsHiddenMessage  (3 cases)
  TestParseEvent_JSON_IsHiddenMessage             (3 cases)
  TestResolveSendOptions                          (8 cases)
  TestSend_BranchesOnVisibility                   (4 cases)

* feat(bitrix24): openline sender-tag echo on replies [B24:2794]

Openline sender-tag echo (this change):
- Capture the connector sender tag ("[name #id]:" or "[name] #id:") from
  inbound openline group messages, strip it from the body the agent sees,
  and re-prepend the canonical "[name] #id:" form to the reply so the Open
  Channel connector routes the answer back to the right external user.
- New sender_prefix.go helper (+ test) accepts both inbound layouts and
  emits one canonical form; scoped to messages carrying the tag, so plain
  chats are unaffected.
- metadata_keys.go: MetaKeySenderPrefix; handle.go capture/strip/stash;
  gateway_consumer_normal.go forwards the key; send.go prepends it on the
  first chunk before chunking.

Bundled bitrix24 channel-core work already on this branch:
- handle.go: @mention is the sole trigger for both staff and connector
  customers; unmentioned traffic is dropped (was: drop all connector msgs).
- isGroupMessageType: treat SONET_GROUP "B" as a group.
- handle_test.go, mcp_client_test.go: cover the above.

* feat(bitrix24): accept colon-less openline sender tag, echo [name] #id [B24:2794]

The Open Channel connector dropped the trailing colon from its sender tag:
inbound now arrives as "[Name] #id <msg>" (was "[Name] #id: <msg>"). The
id-bearing patterns required the colon, so the tag fell through to the
name-only branch and the reply echoed "[Name]" — dropping the #id the
connector needs to route the answer back.

- sender_prefix.go: make the trailing ":" optional on both id layouts
  ([name #id] / [name] #id, with or without colon) and echo the canonical
  "[name] #id" (no colon) to match the connector's current format. Bare
  "[name]" (no id) still echoes "[name]" for Open Channel only.
- handle.go: gate the bare name-only layout to Open Channel (isOpenChannel)
  so ordinary group chats starting with "[x] ..." are left untouched.
- sender_prefix_test.go: cover colon/no-colon x id-inside/id-outside, the
  name-only openline case, and the non-openline no-op.

* fix: security and robustness fixes from the bitrix24 channel review [B24:2794]

- download.go: block redirect-based SSRF on inbound media. CheckRedirect
  re-validates each hop (http(s) only, reject private/loopback/link-local
  hosts, cap hops); the initial portal-domain pin is no longer bypassable
  via a 3xx to an internal service. Public-host redirects still allowed.
- handle.go: extract/echo the openline sender tag only for Open Channel
  sessions (was: any group chat), removing bogus prefixes in CRM group
  chats and narrowing the forged-tag misroute surface.
- loop_tools.go + loop_media.go: confine result.Media to the agent / team /
  tenant-allowed roots (new confineToAnyRoot) before a channel uploads it,
  so a prompt-injected out-of-workspace path (e.g. /etc/passwd) cannot
  exfiltrate, while legitimate cross-workspace media (team files, delegatee
  output) still flows.
- send_media.go: bounded outbound read via io.LimitReader replaces the
  os.Stat + os.ReadFile pair, closing the TOCTOU size-cap bypass; cap a
  single message's outbound attachments at 10 (mirrors inbound).
- register.go: paginate imbot.v2.Bot.list (limit/offset + hasNextPage,
  capped at 40 pages) so verify/lookup see bots past the first 50.
- mcp_client.go: redact access_token / refresh_token / client_secret from an
  echoed MCP error body before it is logged or returned (+ test).

* fix(security): validate resolved dial IP on Bitrix media redirects [B24:2794]

The inbound media download redirect guard only string-checked the redirect
hostname (isPrivateOrLoopback on req.URL.Hostname()), so a redirect to a public
hostname that resolves to 127.0.0.1 / 169.254.169.254 / an RFC1918 address — or a
DNS-rebinding swap between check and dial — still passed the guard and the client
would connect. Reported in PR review.

Add security.NewRedirectFollowingSafeClient: it follows redirects but validates
the RESOLVED destination IP of every hop at dial time via net.Dialer.Control,
reusing the existing blocked-CIDR list. The IP it checks is the IP actually
dialed, so both redirect-to-internal and DNS rebinding are refused, while
legitimate public CDN redirects still succeed. download.go now uses it instead of
the hostname-string guard.

Tests: deterministic dial-control table (loopback / link-local / private /
multicast / unspecified / public, v4 + v6), malformed/non-IP addr, test bypass,
loopback-dial-blocked client wiring, and redirect cap + scheme checks.

* feat(bitrix24): per-participant Zalo openline identity from 3-token sender tag [B24:2794]

Parse the connector's "[Name] #uid #msgId" sender tag so each external
customer in a shared Open Channel group gets its own contact + USER.md
instead of collapsing onto the connector proxy id. Identity minting is
gated on IS_CONNECTOR=Y to reject operator forged tags. Echo back the
msgId only ("#msgId") on replies; keep the legacy single-number and
name-only layouts unchanged. Zero DB migration.

- sender_prefix.go: parseOpenlineSenderTag() classifies 3-token / legacy / name-only
- handle.go: synthetic senderID "openlines:{instance}:{chat}:{uid}" + participant_user_id metadata, gated on FromIsConnector
- gateway_consumer_normal.go: deriveGroupUserID() routes participant -> per-person scope, group fallback otherwise
- send.go: buildAddressMention numeric-id guard so synthetic ids don't emit invalid [USER=...] BBCode
- MetaKeyMessageID kept as Bitrix MESSAGE_ID (drives v2 fields.replyId); connector msgId surfaced only via echo prefix

---------

Co-authored-by: DangTinh311 <dangtinh31193@gmail.com>
Co-authored-by: Chinh Dang <chinhdang@192.168.68.104>
2026-06-22 14:23:34 +07:00

439 lines
13 KiB
Go

package bitrix24
import (
"context"
"encoding/base64"
"os"
"path/filepath"
"testing"
"github.com/nextlevelbuilder/goclaw/internal/bus"
)
// TestUploadOneFile_HappyPath tests successful file upload with correct base64 encoding.
func TestUploadOneFile_HappyPath(t *testing.T) {
const testContent = "this is the file content"
// Create a temp file with test content
tmpFile, err := os.CreateTemp("", "test_upload_*.txt")
if err != nil {
t.Fatalf("create temp file: %v", err)
}
defer os.Remove(tmpFile.Name())
if _, err := tmpFile.Write([]byte(testContent)); err != nil {
t.Fatalf("write temp file: %v", err)
}
tmpFile.Close()
// Use stub RoundTripper to capture requests and return canned responses
rt := &captureRT{
result: `{"result":{"fileId":12345}}`,
}
ch, _ := newFakeChannelWithClient(t, newStubClient("test.bitrix24.com", rt))
m := bus.MediaAttachment{URL: tmpFile.Name()}
err = ch.uploadOneFile(context.Background(), ch.Client(), 1, "chat123", m)
if err != nil {
t.Fatalf("uploadOneFile: %v", err)
}
}
// TestUploadOneFile_EmptyPath tests that empty URL is rejected.
func TestUploadOneFile_EmptyPath(t *testing.T) {
ch, _ := newFakeChannelWithClient(t, NewClient("test.bitrix24.com", nil))
m := bus.MediaAttachment{URL: ""}
err := ch.uploadOneFile(context.Background(), ch.Client(), 1, "chat123", m)
if err == nil {
t.Fatal("expected error for empty URL")
}
}
// TestUploadOneFile_MissingFile tests that non-existent file is rejected.
func TestUploadOneFile_MissingFile(t *testing.T) {
ch, _ := newFakeChannelWithClient(t, NewClient("test.bitrix24.com", nil))
m := bus.MediaAttachment{URL: "/nonexistent/file/path.txt"}
err := ch.uploadOneFile(context.Background(), ch.Client(), 1, "chat123", m)
if err == nil {
t.Fatal("expected error for missing file")
}
}
// TestUploadOneFile_FileTooLarge tests that files exceeding maxOutboundMediaBytesFallback
// are rejected without an upload call.
func TestUploadOneFile_FileTooLarge(t *testing.T) {
// Create a temp file larger than the cap
tmpFile, err := os.CreateTemp("", "large_*.bin")
if err != nil {
t.Fatalf("create temp file: %v", err)
}
defer os.Remove(tmpFile.Name())
// Write more than maxOutboundMediaBytesFallback
largeSize := maxOutboundMediaBytesFallback + 1000
if _, err := tmpFile.Write(make([]byte, largeSize)); err != nil {
t.Fatalf("write temp file: %v", err)
}
tmpFile.Close()
ch, _ := newFakeChannelWithClient(t, NewClient("test.bitrix24.com", nil))
m := bus.MediaAttachment{URL: tmpFile.Name()}
err = ch.uploadOneFile(context.Background(), ch.Client(), 1, "chat123", m)
if err == nil {
t.Fatal("expected error for oversized file")
}
}
// TestUploadOneFile_CorrectBase64Encoding tests that file content is
// correctly base64-encoded (without data: prefix) in the upload call.
func TestUploadOneFile_CorrectBase64Encoding(t *testing.T) {
const testContent = "hello world from file"
tmpFile, err := os.CreateTemp("", "test_encoding_*.txt")
if err != nil {
t.Fatalf("create temp file: %v", err)
}
defer os.Remove(tmpFile.Name())
if _, err := tmpFile.Write([]byte(testContent)); err != nil {
t.Fatalf("write temp file: %v", err)
}
tmpFile.Close()
// Use stub RoundTripper to capture the upload request
rt := &captureRT{
result: `{"result":{"fileId":12345}}`,
}
ch, _ := newFakeChannelWithClient(t, newStubClient("test.bitrix24.com", rt))
m := bus.MediaAttachment{URL: tmpFile.Name()}
err = ch.uploadOneFile(context.Background(), ch.Client(), 1, "chat123", m)
if err != nil {
t.Fatalf("uploadOneFile: %v", err)
}
// Verify the base64 content matches what we expect
if len(rt.reqs) == 0 {
t.Fatal("no requests captured")
}
capturedContent := rt.reqs[0].Get("fields[FILE][content]")
expectedB64 := base64.StdEncoding.EncodeToString([]byte(testContent))
if capturedContent != expectedB64 {
t.Errorf("base64 content mismatch: got %q, want %q", capturedContent, expectedB64)
}
}
// TestUploadOneFile_NoDataPrefix tests that base64 does NOT include a data: prefix.
func TestUploadOneFile_NoDataPrefix(t *testing.T) {
tmpFile, err := os.CreateTemp("", "test_prefix_*.txt")
if err != nil {
t.Fatalf("create temp file: %v", err)
}
defer os.Remove(tmpFile.Name())
if _, err := tmpFile.Write([]byte("test")); err != nil {
t.Fatalf("write temp file: %v", err)
}
tmpFile.Close()
// Use stub RoundTripper to capture the upload request
rt := &captureRT{
result: `{"result":{"fileId":1}}`,
}
ch, _ := newFakeChannelWithClient(t, newStubClient("test.bitrix24.com", rt))
m := bus.MediaAttachment{URL: tmpFile.Name()}
_ = ch.uploadOneFile(context.Background(), ch.Client(), 1, "chat123", m)
// Verify NO data: prefix
if len(rt.reqs) == 0 {
t.Fatal("no requests captured")
}
capturedContent := rt.reqs[0].Get("fields[FILE][content]")
if len(capturedContent) > 5 && capturedContent[:5] == "data:" {
t.Errorf("base64 should NOT have data: prefix, got %q", capturedContent[:20])
}
}
// TestUploadOneFile_CorrectBotIDDialogID tests that botId and dialogId are
// passed correctly in the upload call.
func TestUploadOneFile_CorrectBotIDDialogID(t *testing.T) {
tmpFile, err := os.CreateTemp("", "test_ids_*.txt")
if err != nil {
t.Fatalf("create temp file: %v", err)
}
defer os.Remove(tmpFile.Name())
if _, err := tmpFile.Write([]byte("data")); err != nil {
t.Fatalf("write temp file: %v", err)
}
tmpFile.Close()
// Use stub RoundTripper to capture the upload request
rt := &captureRT{
result: `{"result":{"fileId":1}}`,
}
ch, _ := newFakeChannelWithClient(t, newStubClient("test.bitrix24.com", rt))
m := bus.MediaAttachment{URL: tmpFile.Name()}
_ = ch.uploadOneFile(context.Background(), ch.Client(), 42, "dialog999", m)
// Verify botId and dialogId were passed correctly
if len(rt.reqs) == 0 {
t.Fatal("no requests captured")
}
capturedBotID := rt.reqs[0].Get("botId")
capturedDialogID := rt.reqs[0].Get("dialogId")
if capturedBotID != "42" {
t.Errorf("botId = %q; want 42", capturedBotID)
}
if capturedDialogID != "dialog999" {
t.Errorf("dialogId = %q; want dialog999", capturedDialogID)
}
}
// TestSendMedia_NoClient tests that sendMedia fails when channel has no client.
func TestSendMedia_NoClient(t *testing.T) {
ch := &Channel{}
msg := bus.OutboundMessage{
ChatID: "chat1",
Media: []bus.MediaAttachment{
{URL: "/some/file.txt"},
},
}
err := ch.sendMedia(context.Background(), msg)
if err == nil {
t.Fatal("expected error when channel has no client")
}
}
// TestSendMedia_InvalidBotID tests that sendMedia fails when botID is invalid.
func TestSendMedia_InvalidBotID(t *testing.T) {
ch, _ := newFakeChannelWithClient(t, NewClient("test.bitrix24.com", nil))
ch.startMu.Lock()
ch.botID = 0 // Invalid botID
ch.startMu.Unlock()
msg := bus.OutboundMessage{
ChatID: "chat1",
Media: []bus.MediaAttachment{
{URL: "/some/file.txt"},
},
}
err := ch.sendMedia(context.Background(), msg)
if err == nil {
t.Fatal("expected error when botID is invalid")
}
}
// TestSendMedia_EmptyMedia tests that empty media list returns no error.
func TestSendMedia_EmptyMedia(t *testing.T) {
ch, _ := newFakeChannelWithClient(t, NewClient("test.bitrix24.com", nil))
msg := bus.OutboundMessage{
ChatID: "chat1",
Media: []bus.MediaAttachment{},
}
err := ch.sendMedia(context.Background(), msg)
if err != nil {
t.Fatalf("sendMedia with empty media should not error: %v", err)
}
}
// TestSendMedia_SingleFile_Success tests uploading a single file successfully.
func TestSendMedia_SingleFile_Success(t *testing.T) {
tmpFile, err := os.CreateTemp("", "single_*.txt")
if err != nil {
t.Fatalf("create temp file: %v", err)
}
defer os.Remove(tmpFile.Name())
if _, err := tmpFile.Write([]byte("content")); err != nil {
t.Fatalf("write temp file: %v", err)
}
tmpFile.Close()
// Use stub RoundTripper
rt := &captureRT{
result: `{"result":{"fileId":1}}`,
}
ch, _ := newFakeChannelWithClient(t, newStubClient("test.bitrix24.com", rt))
msg := bus.OutboundMessage{
ChatID: "chat1",
Media: []bus.MediaAttachment{
{URL: tmpFile.Name()},
},
}
err = ch.sendMedia(context.Background(), msg)
if err != nil {
t.Fatalf("sendMedia single file: %v", err)
}
}
// TestSendMedia_MultipleFiles_AllSucceed tests uploading multiple files.
func TestSendMedia_MultipleFiles_AllSucceed(t *testing.T) {
// Create two temp files
tmpFile1, err := os.CreateTemp("", "file1_*.txt")
if err != nil {
t.Fatalf("create temp file 1: %v", err)
}
defer os.Remove(tmpFile1.Name())
if _, err := tmpFile1.Write([]byte("content1")); err != nil {
t.Fatalf("write temp file 1: %v", err)
}
tmpFile1.Close()
tmpFile2, err := os.CreateTemp("", "file2_*.txt")
if err != nil {
t.Fatalf("create temp file 2: %v", err)
}
defer os.Remove(tmpFile2.Name())
if _, err := tmpFile2.Write([]byte("content2")); err != nil {
t.Fatalf("write temp file 2: %v", err)
}
tmpFile2.Close()
// Use stub RoundTripper to track multiple uploads
rt := &captureRT{
result: `{"result":{"fileId":1}}`,
}
ch, _ := newFakeChannelWithClient(t, newStubClient("test.bitrix24.com", rt))
msg := bus.OutboundMessage{
ChatID: "chat1",
Media: []bus.MediaAttachment{
{URL: tmpFile1.Name()},
{URL: tmpFile2.Name()},
},
}
errSend := ch.sendMedia(context.Background(), msg)
if errSend != nil {
t.Fatalf("sendMedia multiple files: %v", errSend)
}
if len(rt.reqs) != 2 {
t.Errorf("expected 2 uploads, got %d", len(rt.reqs))
}
}
// TestSendMedia_PartialFailure tests that one file failing returns the first
// error but continues processing other files.
func TestSendMedia_PartialFailure(t *testing.T) {
tmpFile1, err := os.CreateTemp("", "good_*.txt")
if err != nil {
t.Fatalf("create temp file 1: %v", err)
}
defer os.Remove(tmpFile1.Name())
if _, err := tmpFile1.Write([]byte("content1")); err != nil {
t.Fatalf("write temp file 1: %v", err)
}
tmpFile1.Close()
tmpFile2, err := os.CreateTemp("", "bad_*.txt")
if err != nil {
t.Fatalf("create temp file 2: %v", err)
}
defer os.Remove(tmpFile2.Name())
if _, err := tmpFile2.Write([]byte("content2")); err != nil {
t.Fatalf("write temp file 2: %v", err)
}
tmpFile2.Close()
// Use stub RoundTripper that returns different responses for each request
rtPartial := &captureRTPartialFail{}
ch, _ := newFakeChannelWithClient(t, newStubClient("test.bitrix24.com", rtPartial))
msg := bus.OutboundMessage{
ChatID: "chat1",
Media: []bus.MediaAttachment{
{URL: tmpFile1.Name()},
{URL: tmpFile2.Name()},
},
}
errSend2 := ch.sendMedia(context.Background(), msg)
// Should return first error but have attempted both uploads
if errSend2 == nil {
t.Fatal("expected error from second file")
}
if rtPartial.calls != 2 {
t.Errorf("expected 2 upload attempts, got %d", rtPartial.calls)
}
}
// TestSendMedia_SkipsWithMissingFile tests that a missing file is skipped
// and does not block other files.
func TestSendMedia_SkipsWithMissingFile(t *testing.T) {
tmpFile, err := os.CreateTemp("", "good_*.txt")
if err != nil {
t.Fatalf("create temp file: %v", err)
}
defer os.Remove(tmpFile.Name())
if _, err := tmpFile.Write([]byte("content")); err != nil {
t.Fatalf("write temp file: %v", err)
}
tmpFile.Close()
// Use stub RoundTripper to track uploads
rt := &captureRT{
result: `{"result":{"fileId":1}}`,
}
ch, _ := newFakeChannelWithClient(t, newStubClient("test.bitrix24.com", rt))
msg := bus.OutboundMessage{
ChatID: "chat1",
Media: []bus.MediaAttachment{
{URL: "/nonexistent/file1.txt"},
{URL: tmpFile.Name()},
{URL: "/nonexistent/file3.txt"},
},
}
errSend3 := ch.sendMedia(context.Background(), msg)
// Should return error from first missing file
if errSend3 == nil {
t.Fatal("expected error from missing files")
}
// sendMedia continues through all files: fails on file1 (missing), succeeds on file2 (good), fails on file3 (missing)
// So exactly 1 upload should be attempted (the good file)
if len(rt.reqs) != 1 {
t.Errorf("expected 1 upload attempt (the good file), got %d", len(rt.reqs))
}
}
// TestSendMedia_FilenameSanitized tests that uploaded filename uses filepath.Base
// (no path traversal).
func TestSendMedia_FilenameSanitized(t *testing.T) {
tmpDir, err := os.MkdirTemp("", "test_")
if err != nil {
t.Fatalf("create temp dir: %v", err)
}
defer os.RemoveAll(tmpDir)
// Create file with path separators in name
tmpFile := filepath.Join(tmpDir, "actual_file.txt")
if err := os.WriteFile(tmpFile, []byte("content"), 0644); err != nil {
t.Fatalf("write file: %v", err)
}
// Use stub RoundTripper to capture filename
rt := &captureRT{
result: `{"result":{"fileId":1}}`,
}
ch, _ := newFakeChannelWithClient(t, newStubClient("test.bitrix24.com", rt))
msg := bus.OutboundMessage{
ChatID: "chat1",
Media: []bus.MediaAttachment{
{URL: tmpFile},
},
}
_ = ch.sendMedia(context.Background(), msg)
// Filename should be just "actual_file.txt", no directory path
if len(rt.reqs) == 0 {
t.Fatal("no requests captured")
}
capturedFilename := rt.reqs[0].Get("fields[FILE][name]")
if capturedFilename != "actual_file.txt" {
t.Errorf("filename = %q; want actual_file.txt", capturedFilename)
}
}