timmy-talking-turd/tests/image-polyglot.test.js

// Container/polyglot rejection contract.
//
// The requirement is malformed/polyglot REJECTION, not "the re-encoder happens
// to drop the tail". Rejection must come from canonical parsing of the image
// container — the declared structure must consume exactly the supplied bytes —
// so it cannot be evaded by changing keyword casing or archive flavour, and it
// must not fire on arbitrary compressed bytes that merely contain those
// sequences inside legal image structure.
import test from 'node:test';
import assert from 'node:assert/strict';
import { readFile } from 'node:fs/promises';
import { fileURLToPath } from 'node:url';

import { validateImageIngress } from '../src/image-ingress.js';
import { analyzePhoto } from '../src/vision-service.js';

const fixture = (name) => fileURLToPath(new URL(`../tests/fixtures/${name}`, import.meta.url));
const readFixture = (name) => readFile(fixture(name));
const dataUrl = (bytes, mime = 'image/jpeg') => `data:${mime};base64,${bytes.toString('base64')}`;

const TRAILING_DATA_FIXTURES = [
  ['ingress-tail-upper-script.jpg', 'uppercase <SCRIPT> tail'],
  ['ingress-tail-mixed-script.jpg', 'mixed-case <ScRiPt> tail'],
  ['ingress-tail-html.jpg', 'generic appended HTML with no script tag'],
  ['ingress-tail-zip-eocd.jpg', 'ZIP end-of-central-directory tail'],
  ['ingress-tail-zip-local.jpg', 'ZIP local-header tail'],
  ['ingress-tail-rar.jpg', 'RAR archive tail'],
  ['ingress-tail-7z.jpg', '7z archive tail'],
  ['ingress-tail-gzip.jpg', 'gzip member tail'],
  ['ingress-tail-single-nul.jpg', 'single appended NUL byte'],
];

test('appended trailing data is rejected regardless of casing or container flavour', async () => {
  for (const [name, description] of TRAILING_DATA_FIXTURES) {
    const bytes = await readFixture(name);
    await assert.rejects(
      () => validateImageIngress({ consent: true, imageDataUrl: dataUrl(bytes) }),
      (error) => {
        assert.match(error.message, /not a supported image|corrupt or malformed/i,
          `${description} must be rejected with a sanitized ingress error`);
        return true;
      },
      `${description} must not pass ingress`,
    );
  }
});

test('trailing data after a PNG IEND chunk is rejected', async () => {
  const bytes = await readFixture('ingress-tail-after-iend.png');
  await assert.rejects(
    () => validateImageIngress({ consent: true, imageDataUrl: dataUrl(bytes, 'image/png') }),
    /not a supported image|corrupt or malformed/i,
  );
});

test('rejection is structural, not substring scanning: legal images carrying archive and script byte sequences are accepted', async () => {
  // A JPEG COM segment legally contains arbitrary bytes. These exact sequences
  // are what the old scanner searched for; canonical parsing must still accept.
  const buried = await readFixture('ingress-buried-signatures.jpg');
  assert.ok(buried.includes(Buffer.from('PK\x03\x04')), 'fixture must contain a ZIP local header sequence');
  assert.ok(buried.includes(Buffer.from('PK\x05\x06')), 'fixture must contain a ZIP EOCD sequence');
  assert.ok(buried.includes(Buffer.from('<script')), 'fixture must contain a lowercase script sequence');
  const result = await validateImageIngress({ consent: true, imageDataUrl: dataUrl(buried) });
  assert.equal(result.format, 'jpeg');
  assert.ok(result.bytes > 0);

  // High-entropy compressed data must not be misclassified either.
  const entropy = await readFixture('ingress-entropy-control.jpg');
  const entropyResult = await validateImageIngress({ consent: true, imageDataUrl: dataUrl(entropy) });
  assert.equal(entropyResult.format, 'jpeg');
});

test('the provider is never reached for any trailing-data polyglot', async () => {
  for (const [name] of TRAILING_DATA_FIXTURES) {
    const bytes = await readFixture(name);
    let providerCalled = false;
    await assert.rejects(
      () => analyzePhoto({
        payload: { consent: true, imageDataUrl: dataUrl(bytes) },
        config: { model: 'm', baseUrl: 'http://127.0.0.1:9/v1' },
        fetchImpl: async () => { providerCalled = true; throw new Error('provider reached'); },
      }),
    );
    assert.equal(providerCalled, false, `${name} must fail before any provider fetch`);
  }
});