For the junk judge: a "movie" whose first bytes are a program is fake. Two bytes alone match random data too often, so the PE signature where the DOS header points must be there too. No PROBE_VERSION bump: new probes only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
21 lines
799 B
TypeScript
21 lines
799 B
TypeScript
import { test } from '@japa/runner'
|
|
import { sniffContentType } from '#lib/content/sniff'
|
|
|
|
test.group('content / sniff', () => {
|
|
test('a Windows executable: MZ with a PE header where the DOS header points', ({ assert }) => {
|
|
const exe = Buffer.alloc(0x100)
|
|
exe.write('MZ', 0, 'latin1')
|
|
exe.writeUInt32LE(0x80, 0x3c)
|
|
exe.write('PE\0\0', 0x80, 'latin1')
|
|
assert.equal(sniffContentType(exe), 'exe')
|
|
// MZ alone (random data, a text) is no executable.
|
|
const mz = Buffer.alloc(0x100)
|
|
mz.write('MZ', 0, 'latin1')
|
|
assert.isNull(sniffContentType(mz))
|
|
// A pointer past the data: none.
|
|
mz.writeUInt32LE(0xffff, 0x3c)
|
|
assert.isNull(sniffContentType(mz))
|
|
assert.equal(sniffContentType(Buffer.from([0x1a, 0x45, 0xdf, 0xa3, 0, 0, 0, 0])), 'matroska')
|
|
})
|
|
})
|