tidying up tests and fixtures

Author: dackers86

.gitignore

@@ -17,4 +17,6 @@ coverage
 yarn.lock
 _emulator/pubsub-debug.log
 firestore-debug.log
-pubsub-debug.log
+pubsub-debug.log
+tmp/
+fixtures/

storage-resize-images/functions/__tests__/fixtures/config.json

@@ -0,0 +1 @@
+{ "some": "secret" }

storage-resize-images/functions/__tests__/fixtures/config_hack.txt

@@ -0,0 +1 @@
+data:text/plain;,'Hello from hacker'

storage-resize-images/functions/__tests__/fixtures/settings.json

@@ -0,0 +1 @@
+{ "status": "active" }

storage-resize-images/functions/__tests__/storage.rules

@@ -0,0 +1,17 @@
+rules_version = '2';
+service firebase.storage {
+  match /b/{bucket}/o {
+    
+    match /users/{userId}/images/{documents=**} {
+      allow read, write;
+    }
+  
+    match /users/{userId}/images/thumbs/{image} {
+      allow read: if image.matches('.*\\.png');
+    }
+    
+    match /config.json {
+      allow read, write;
+    }
+  }
+}

storage-resize-images/functions/__tests__/vulnerability.test.ts

@@ -8,6 +8,7 @@ const exec = util.promisify(require("child_process").exec);
 
 /**
  * e2e testing for discovered storage vulnerability
+ * Ensure the following rules from __tests__/fixtures/storage.rules are in place:
  */
 
 // Initialize Firebase app first
@@ -29,33 +30,31 @@ const storage = firebaseStorage.getStorage();
 /** basic configuration */
 const username = "[email protected]";
 const password = "L33tH4cker";
+const userId = "RiosyEksHRYop824nECwfBIuJmn1";
+const secondaryUserId = "UuAG5c2Iyqec9fKlNo4dJYsp5B23";
+const filePath = "/fixtures/config_hack.txt";
+const project_id = "extensions-testing";
 
 describe("failed resize vulnerability", () => {
-  let userId;
-  let filePath;
   let dest;
-  let project_id;
   let bucketName;
 
   beforeAll(async () => {
     /** config */
-    userId = "RiosyEksHRYop824nECwfBIuJmn1";
-    filePath = "/../fixtures/config_hack.txt";
     dest = `users/${userId}/images/../../../config.json`;
-    project_id = "extensions-testing";
     bucketName = `gs://${project_id}.appspot.com`;
   });
   test("should not write a file to a storage subdirectory", async () => {
     /** Upload the original file */
-    // const configRef = firebaseStorage.ref(storage, "config.json");
+    const configRef = firebaseStorage.ref(storage, "config.json");
 
     /** Get the file buffer */
-    // const buffer = fs.readFileSync(__dirname + "/../fixtures/config.json");
+    const buffer = fs.readFileSync(__dirname + "/fixtures/config.json");
 
     /** Upload the original file */
-    // await firebaseStorage.uploadBytes(configRef, buffer).then(() => {
-    //   console.log("File upload succeed");
-    // });
+    await firebaseStorage.uploadBytes(configRef, buffer).then(() => {
+      console.log("File upload succeed");
+    });
 
     /** Wait for 5 seconds to propegate */
     await new Promise((resolve) => setTimeout(resolve, 5000));
@@ -69,7 +68,7 @@ describe("failed resize vulnerability", () => {
 
     /** Confirm correct files are in place */
     await exec(`echo 'Step 2:' && cat ./tmp/config.json`).then(({ stdout }) => {
-      expect(stdout.trim()).toEqual('Step 2:\n{\n    "some" : "secret"\n}');
+      expect(stdout.trim()).toEqual('Step 2:\n{"some":"secret"}');
     });
 
     /** Add logging */
@@ -109,51 +108,38 @@ describe("failed resize vulnerability", () => {
     /** Check file */
     await exec(`echo 'Step 4:' && cat ./tmp/config.json`).then(({ stdout }) => {
       /** Check file */
-      expect(stdout.trim()).toEqual('Step 4:\n{\n    "some" : "secret"\n}');
+      expect(stdout.trim()).toEqual('Step 4:\n{"some":"secret"}');
     });
 
-    /** Clear file */
-    // await exec(`echo 'Step 5:' && rm -f ./tmp/config.json`).then(
-    //   ({ stdout }) => {
-    //     /** Check file */
-    //     expect(stdout.trim()).toEqual("Step 5:");
-    //   }
-    // );
-
     /** Check results */
     expect(true).toBe(true);
   }, 60000);
 });
 
 describe("allowed paths vulnerability", () => {
-  let userId;
-  let secondaryUserId;
-  let filePath;
   let dest;
-  let project_id;
   let bucketName;
 
   beforeAll(async () => {
     /** config */
-    userId = "RiosyEksHRYop824nECwfBIuJmn1";
-    secondaryUserId = "UuAG5c2Iyqec9fKlNo4dJYsp5B23";
-    filePath = "/../fixtures/config_hack.txt";
-    dest = `users/${userId}/images/../../${secondaryUserId}/config.json`;
-    project_id = "extensions-testing";
+    dest = `users/${userId}/images/../../${secondaryUserId}/settings.json`;
     bucketName = `gs://${project_id}.appspot.com`;
   });
 
   test("should not write a file to a storage subdirectory", async () => {
     /** Upload the original file */
-    // const configRef = firebaseStorage.ref(storage, "config.json");
+    const settingsRef = firebaseStorage.ref(
+      storage,
+      `users/${secondaryUserId}/settings.json`
+    );
 
     /** Get the file buffer */
-    // const buffer = fs.readFileSync(__dirname + "/../fixtures/config.json");
+    const buffer = fs.readFileSync(__dirname + "/fixtures/settings.json");
 
     /** Upload the original file */
-    // await firebaseStorage.uploadBytes(configRef, buffer).then(() => {
-    //   console.log("File upload succeed");
-    // });
+    await firebaseStorage.uploadBytes(settingsRef, buffer).then(() => {
+      console.log("File upload succeed");
+    });
 
     /** Wait for 5 seconds to propegate */
     await new Promise((resolve) => setTimeout(resolve, 5000));
@@ -173,7 +159,7 @@ describe("allowed paths vulnerability", () => {
     /** Confirm correct files are in place */
     await exec(`echo 'Step 2:' && cat ./tmp/settings.json`).then(
       ({ stdout }) => {
-        expect(stdout.trim()).toEqual('Step 2:\n{\n    "status" : "active"\n}');
+        expect(stdout.trim()).toEqual('Step 2:\n{"status":"active"}');
       }
     );
 
@@ -221,7 +207,7 @@ describe("allowed paths vulnerability", () => {
     await exec(`echo 'Step 4:' && cat ./tmp/settings.json`).then(
       ({ stdout }) => {
         /** Check file */
-        expect(stdout.trim()).toEqual('Step 4:\n{\n    "status" : "active"\n}');
+        expect(stdout.trim()).toEqual('Step 4:\n{"status":"active"}');
       }
     );
   }, 60000);

storage-resize-images/functions/fixtures/config.json

@@ -11,7 +11,7 @@ module.exports = {
   },
   preset: "ts-jest",
   setupFiles: ["<rootDir>/__tests__/jest.setup.ts"],
-  testMatch: ["**/__tests__/*.test.ts"],
+  testMatch: ["**/__tests__/vulnerability.test.ts"],
   moduleNameMapper: {
     "firebase-admin/eventarc":
       "<rootDir>/node_modules/firebase-admin/lib/eventarc",