validate submissionSource and raise if not valid

Author: eviljeff

src/util/submit-addon.js

@@ -423,7 +423,7 @@ export async function signAddon({
     const stats = await fsPromises.stat(xpiPath);
 
     if (!stats.isFile()) {
-      throw new Error(`not a file: ${xpiPath}`);
+      throw new Error('not a file');
     }
   } catch (statError) {
     throw new Error(`error with ${xpiPath}: ${statError}`);
@@ -450,12 +450,20 @@ export async function signAddon({
     channel,
     savedUploadUuidPath,
   );
+  const patchData = {};
   // if we have a source file we need to upload we patch after the create
-  const patchData = {
-    version: submissionSource
-      ? { source: client.fileFromSync(submissionSource) }
-      : undefined,
-  };
+  if (submissionSource) {
+    try {
+      const stats2 = await fsPromises.stat(submissionSource);
+
+      if (!stats2.isFile()) {
+        throw new Error('not a file');
+      }
+    } catch (statError) {
+      throw new Error(`error with ${submissionSource}: ${statError}`);
+    }
+    patchData.version = { source: client.fileFromSync(submissionSource) };
+  }
 
   // We specifically need to know if `id` has not been passed as a parameter because
   // it's the indication that a new add-on should be created, rather than a new version.

tests/unit/test-util/test.submit-addon.js

@@ -57,7 +57,9 @@ describe('util.submit-addon', () => {
     beforeEach(() => {
       statStub = sinon
         .stub(fsPromises, 'stat')
+        .onFirstCall()
         .resolves({ isFile: () => true });
+      statStub.callThrough();
       getPreviousUuidOrUploadXpiStub = sinon
         .stub(Client.prototype, 'getPreviousUuidOrUploadXpi')
         .resolves(uploadUuid);
@@ -197,6 +199,7 @@ describe('util.submit-addon', () => {
 
     it('includes source data to be patched if submissionSource defined for new addon', async () => {
       const submissionSource = 'path/to/source/zip';
+      statStub.onSecondCall().resolves({ isFile: () => true });
       await signAddon({
         ...signAddonDefaults,
         submissionSource,
@@ -214,6 +217,7 @@ describe('util.submit-addon', () => {
 
     it('includes source data to be patched if submissionSource defined for new version', async () => {
       const submissionSource = 'path/to/source/zip';
+      statStub.onSecondCall().resolves({ isFile: () => true });
       const id = '@thisID';
       await signAddon({
         ...signAddonDefaults,
@@ -230,6 +234,34 @@ describe('util.submit-addon', () => {
         { version: { source: fakeFileFromSync } },
       );
     });
+
+    it('throws error if submissionSource is not found', async () => {
+      const submissionSource = 'path/to/source/zip';
+      const signAddonPromise = signAddon({
+        ...signAddonDefaults,
+        submissionSource,
+      });
+      await assert.isRejected(
+        signAddonPromise,
+        `error with ${submissionSource}: ` +
+          'Error: ENOENT: no such file or directory',
+      );
+    });
+
+    it('throws error if submissionSource is a directory', async () => {
+      await withTempDir(async (tmpDir) => {
+        const submissionSource = path.join(tmpDir.path(), 'someDirectory');
+        await fsPromises.mkdir(submissionSource);
+        const signAddonPromise = signAddon({
+          ...signAddonDefaults,
+          submissionSource,
+        });
+        await assert.isRejected(
+          signAddonPromise,
+          `error with ${submissionSource}: ` + 'Error: not a file',
+        );
+      });
+    });
   });
 
   describe('Client', () => {