snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

server/public/model/post_reporting_test.go

@@ -0,0 +1,246 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package model
+
+import (
+	"encoding/base64"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestReportPostQueryParamsValidate(t *testing.T) {
+	tests := []struct {
+		name      string
+		params    ReportPostQueryParams
+		wantError bool
+		errorMsg  string
+	}{
+		{
+			name: "valid params with create_at ASC",
+			params: ReportPostQueryParams{
+				ChannelId:          NewId(),
+				CursorTime:         0,
+				CursorId:           "",
+				TimeField:          ReportingTimeFieldCreateAt,
+				SortDirection:      ReportingSortDirectionAsc,
+				IncludeDeleted:     false,
+				ExcludeSystemPosts: false,
+				PerPage:            100,
+			},
+			wantError: false,
+		},
+		{
+			name: "valid params with update_at DESC and cursor",
+			params: ReportPostQueryParams{
+				ChannelId:          NewId(),
+				CursorTime:         123456789,
+				CursorId:           NewId(),
+				TimeField:          ReportingTimeFieldUpdateAt,
+				SortDirection:      ReportingSortDirectionDesc,
+				IncludeDeleted:     true,
+				ExcludeSystemPosts: true,
+				PerPage:            1000,
+			},
+			wantError: false,
+		},
+		{
+			name: "empty ChannelId",
+			params: ReportPostQueryParams{
+				ChannelId:     "",
+				TimeField:     ReportingTimeFieldCreateAt,
+				SortDirection: ReportingSortDirectionAsc,
+				PerPage:       100,
+			},
+			wantError: true,
+			errorMsg:  "channel_id must be a valid 26-character ID",
+		},
+		{
+			name: "invalid ChannelId format",
+			params: ReportPostQueryParams{
+				ChannelId:     "invalid_id",
+				TimeField:     ReportingTimeFieldCreateAt,
+				SortDirection: ReportingSortDirectionAsc,
+				PerPage:       100,
+			},
+			wantError: true,
+			errorMsg:  "channel_id must be a valid 26-character ID",
+		},
+		{
+			name: "invalid TimeField",
+			params: ReportPostQueryParams{
+				ChannelId:     NewId(),
+				TimeField:     "invalid_field",
+				SortDirection: ReportingSortDirectionAsc,
+				PerPage:       100,
+			},
+			wantError: true,
+			errorMsg:  "time_field must be",
+		},
+		{
+			name: "SQL injection attempt in TimeField",
+			params: ReportPostQueryParams{
+				ChannelId:     NewId(),
+				TimeField:     "'; DROP TABLE Posts--",
+				SortDirection: ReportingSortDirectionAsc,
+				PerPage:       100,
+			},
+			wantError: true,
+			errorMsg:  "time_field must be",
+		},
+		{
+			name: "invalid SortDirection",
+			params: ReportPostQueryParams{
+				ChannelId:     NewId(),
+				TimeField:     ReportingTimeFieldCreateAt,
+				SortDirection: "random",
+				PerPage:       100,
+			},
+			wantError: true,
+			errorMsg:  "sort_direction must be",
+		},
+		{
+			name: "SQL injection attempt in SortDirection",
+			params: ReportPostQueryParams{
+				ChannelId:     NewId(),
+				TimeField:     ReportingTimeFieldCreateAt,
+				SortDirection: "ASC; DROP TABLE Posts--",
+				PerPage:       100,
+			},
+			wantError: true,
+			errorMsg:  "sort_direction must be",
+		},
+		{
+			name: "invalid CursorId format",
+			params: ReportPostQueryParams{
+				ChannelId:     NewId(),
+				CursorId:      "invalid_cursor_id",
+				TimeField:     ReportingTimeFieldCreateAt,
+				SortDirection: ReportingSortDirectionAsc,
+				PerPage:       100,
+			},
+			wantError: true,
+			errorMsg:  "cursor_id must be a valid 26-character ID",
+		},
+		{
+			name: "empty CursorId is valid (first page)",
+			params: ReportPostQueryParams{
+				ChannelId:     NewId(),
+				CursorId:      "",
+				TimeField:     ReportingTimeFieldCreateAt,
+				SortDirection: ReportingSortDirectionAsc,
+				PerPage:       100,
+			},
+			wantError: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.params.Validate()
+			if tt.wantError {
+				require.NotNil(t, err, "expected error but got nil")
+				require.Contains(t, err.Error(), tt.errorMsg)
+			} else {
+				require.Nil(t, err, "expected nil error but got: %v", err)
+			}
+		})
+	}
+}
+
+func TestDecodeReportPostCursorV1(t *testing.T) {
+	validChannelId := NewId()
+	validPostId := NewId()
+
+	tests := []struct {
+		name      string
+		cursor    string
+		wantError bool
+		errorMsg  string
+		validate  func(*testing.T, *ReportPostQueryParams)
+	}{
+		{
+			name:      "valid cursor with create_at ASC",
+			cursor:    EncodeReportPostCursor(validChannelId, ReportingTimeFieldCreateAt, false, false, ReportingSortDirectionAsc, 1640000000000, validPostId),
+			wantError: false,
+			validate: func(t *testing.T, params *ReportPostQueryParams) {
+				require.Equal(t, validChannelId, params.ChannelId)
+				require.Equal(t, ReportingTimeFieldCreateAt, params.TimeField)
+				require.Equal(t, ReportingSortDirectionAsc, params.SortDirection)
+				require.Equal(t, int64(1640000000000), params.CursorTime)
+				require.Equal(t, validPostId, params.CursorId)
+				require.False(t, params.IncludeDeleted)
+				require.False(t, params.ExcludeSystemPosts)
+			},
+		},
+		{
+			name:      "valid cursor with update_at DESC",
+			cursor:    EncodeReportPostCursor(validChannelId, ReportingTimeFieldUpdateAt, true, true, ReportingSortDirectionDesc, 1650000000000, validPostId),
+			wantError: false,
+			validate: func(t *testing.T, params *ReportPostQueryParams) {
+				require.Equal(t, validChannelId, params.ChannelId)
+				require.Equal(t, ReportingTimeFieldUpdateAt, params.TimeField)
+				require.Equal(t, ReportingSortDirectionDesc, params.SortDirection)
+				require.Equal(t, int64(1650000000000), params.CursorTime)
+				require.Equal(t, validPostId, params.CursorId)
+				require.True(t, params.IncludeDeleted)
+				require.True(t, params.ExcludeSystemPosts)
+			},
+		},
+		{
+			name:      "invalid base64",
+			cursor:    "not-valid-base64!!!",
+			wantError: true,
+			errorMsg:  "invalid_base64",
+		},
+		{
+			name:      "invalid format - too few parts",
+			cursor:    base64.URLEncoding.EncodeToString([]byte("1:abc:create_at:false:false:asc:123")),
+			wantError: true,
+			errorMsg:  "invalid_format",
+		},
+		{
+			name:      "invalid version",
+			cursor:    base64.URLEncoding.EncodeToString([]byte("2:abc123xyz789012345678901234:create_at:false:false:asc:1640000000000:post123")),
+			wantError: true,
+			errorMsg:  "unsupported_version",
+		},
+		{
+			name:      "invalid boolean for include_deleted",
+			cursor:    base64.URLEncoding.EncodeToString(fmt.Appendf(nil, "1:%s:create_at:not_bool:false:asc:1640000000000:%s", validChannelId, validPostId)),
+			wantError: true,
+			errorMsg:  "invalid_include_deleted",
+		},
+		{
+			name:      "invalid boolean for exclude_system_posts",
+			cursor:    base64.URLEncoding.EncodeToString(fmt.Appendf(nil, "1:%s:create_at:false:not_bool:asc:1640000000000:%s", validChannelId, validPostId)),
+			wantError: true,
+			errorMsg:  "invalid_exclude_system_posts",
+		},
+		{
+			name:      "invalid timestamp",
+			cursor:    base64.URLEncoding.EncodeToString(fmt.Appendf(nil, "1:%s:create_at:false:false:asc:not_a_number:%s", validChannelId, validPostId)),
+			wantError: true,
+			errorMsg:  "invalid_timestamp",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			params, err := DecodeReportPostCursorV1(tt.cursor)
+			if tt.wantError {
+				require.NotNil(t, err, "expected error but got nil")
+				require.Contains(t, err.Error(), tt.errorMsg)
+				require.Nil(t, params)
+			} else {
+				require.Nil(t, err, "expected nil error but got: %v", err)
+				require.NotNil(t, params)
+				if tt.validate != nil {
+					tt.validate(t, params)
+				}
+			}
+		})
+	}
+}