Merged in bugfix/pdf-verification (pull request #218)

fix pdf checking * fix pdf checking https://aarete.atlassian.net/browse/DEVOPS-651
2026-03-20 18:56:21 +00:00
parent 19a28fef17
commit 8e9889accc
5 changed files with 135 additions and 4 deletions
@@ -131,3 +131,85 @@ func TestDocumentCleanClean_ReturnsCleanResult(t *testing.T) {
 	assert.False(t, failResult.Passed, "non-PDF document should fail validation")
 	assert.NotNil(t, failResult.FailReason, "failed document should have a FailReason")
 }
+
+// TestClean_RejectsNonPDFWithPDFContentType verifies that files with
+// application/pdf content type metadata but non-PDF content are rejected.
+// This is the core scenario where S3 metadata lies about the file type.
+func TestClean_RejectsNonPDFWithPDFContentType(t *testing.T) {
+	cfg := &DocCleanConfig{}
+	test.CreateDB(t, cfg)
+	test.CreateAWSResources(t, cfg)
+	ctx := t.Context()
+
+	svc := documentclean.New(cfg)
+
+	uniqueSuffix := uuid.New().String()[:8]
+	clientID := "mimetype_check_" + uniqueSuffix
+	err := cfg.GetDBQueries().CreateClient(ctx, &repository.CreateClientParams{
+		Clientid: clientID,
+		Name:     "Test MIME Check " + uniqueSuffix,
+	})
+	require.NoError(t, err)
+
+	tests := []struct {
+		name    string
+		content []byte
+	}{
+		{
+			name:    "xlsx with PDF content type",
+			content: []byte("PK\x03\x04fake xlsx content that is definitely not a PDF file at all"),
+		},
+		{
+			name:    "OLE2/msg with PDF content type",
+			content: []byte("\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1fake OLE2 msg content not a PDF"),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			location := objectstore.BucketKey{
+				Location:  objectstore.Import,
+				ClientID:  clientID,
+				CreatedAt: time.Now().UTC(),
+				EntityID:  uuid.New(),
+			}
+
+			// Upload with application/pdf content type despite non-PDF content
+			_, err := cfg.GetStoreClient().PutObject(ctx, &s3.PutObjectInput{
+				Bucket:      aws.String(cfg.GetBucket()),
+				Key:         aws.String(location.String()),
+				Body:        bytes.NewReader(tt.content),
+				ContentType: aws.String("application/pdf"),
+			})
+			require.NoError(t, err)
+
+			headResp, err := cfg.GetStoreClient().HeadObject(ctx, &s3.HeadObjectInput{
+				Bucket: aws.String(cfg.GetBucket()),
+				Key:    aws.String(location.String()),
+			})
+			require.NoError(t, err)
+			etag := *headResp.ETag
+
+			docID, err := cfg.GetDBQueries().CreateDocument(ctx, &repository.CreateDocumentParams{
+				Clientid: clientID,
+				Hash:     etag,
+			})
+			require.NoError(t, err)
+
+			err = cfg.GetDBQueries().AddDocumentEntry(ctx, &repository.AddDocumentEntryParams{
+				Documentid: docID,
+				Bucket:     cfg.GetBucket(),
+				Key:        location.String(),
+			})
+			require.NoError(t, err)
+
+			result, err := svc.Clean(ctx, docID)
+			require.NoError(t, err)
+			require.NotNil(t, result)
+			assert.False(t, result.Passed, "file with non-PDF content should be rejected even if content type says application/pdf")
+			require.NotNil(t, result.FailReason, "rejected document should have a FailReason")
+			assert.Equal(t, "invalid_mimetype", *result.FailReason,
+				"non-PDF content should be rejected at MIME type check, not at PDF parse stage")
+		})
+	}
+}