hj/pleroma-fe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix: reject HTML resource indexes

Browse source
This commit is contained in:
Lain Soykaf 2026-08-12 08:18:18 +00:00
commit 13394befaf
2 changed files with 41 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/services/style_setter/style_setter.js
View file

@ -348,7 +348,11 @@ export const getResourcesIndex = async (url, parser = noop) => {
}
try {
const { data: builtinData } = await promisedRequest({ url, cache })
const { data: builtinData } = await promisedRequest({
url,
cache,
forceContentType: 'application/json',
})
builtin = resourceTransform(builtinData)
} catch {
builtin = []
@ -359,6 +363,7 @@ export const getResourcesIndex = async (url, parser = noop) => {
const { data: customData } = await promisedRequest({
url: customUrl,
cache,
forceContentType: 'application/json',
})
custom = resourceTransform(customData)
} catch {

36
test/unit/specs/services/style_setter/style_setter.spec.js
View file

@ -1,4 +1,38 @@
import { hasInvalidCachedThemeRules } from 'src/services/style_setter/style_setter.js'
import {
getResourcesIndex,
hasInvalidCachedThemeRules,
} from 'src/services/style_setter/style_setter.js'
describe('resource index', () => {
afterEach(() => {
vi.restoreAllMocks()
vi.unstubAllGlobals()
})
it('ignores an HTML fallback returned for a missing custom index', async () => {
vi.spyOn(console, 'warn').mockImplementation(() => undefined)
vi.stubGlobal(
'fetch',
vi
.fn()
.mockResolvedValueOnce(
new Response(JSON.stringify({ builtin: { version: 1 } }), {
headers: { 'Content-Type': 'application/json' },
}),
)
.mockResolvedValueOnce(
new Response('<!doctype html><title>Pleroma</title>', {
headers: { 'Content-Type': 'text/html' },
}),
),
)
const resources = await getResourcesIndex('/static/styles.json')
expect(Object.keys(resources)).to.deep.equal(['builtin'])
expect(resources.builtin()).to.deep.equal({ version: 1 })
})
})
describe('style setter cache', () => {
it('rejects cached rules containing serialized objects', () => {