5de50b155a
Line-ending only. Verified: 3667 insertions against 3667 deletions with zero content difference under --ignore-cr-at-eol.
48 lines
1.9 KiB
JavaScript
48 lines
1.9 KiB
JavaScript
"use strict";
|
|
const test = require("node:test");
|
|
const assert = require("node:assert/strict");
|
|
const { isSafeFilename } = require("../main.js").__test__;
|
|
|
|
test("isSafeFilename accepts every filename currently in the vault", () => {
|
|
const real = [
|
|
"Agentic Engineering, explained by a 10x developer.md",
|
|
"Webinar Plan - From Chat Box to Your Own OS.md",
|
|
"Webinar script.md",
|
|
"You're reading way too much code.md",
|
|
"ИИ глупый!.md",
|
|
"Скиллы на базе git — новая память AI-агентов.md",
|
|
"sebastian interview - conclusions and insights.md",
|
|
"In 1 Year, the Gap Between AI Users and Everyone Else Will Be Irreversible.md",
|
|
];
|
|
for (const name of real) {
|
|
assert.equal(isSafeFilename(name), true, `should accept: ${name}`);
|
|
}
|
|
});
|
|
|
|
test("isSafeFilename rejects shell metacharacters", () => {
|
|
for (const bad of ['a".md', "a`b.md", "a$b.md", "a&b.md", "a|b.md", "a;b.md",
|
|
"a<b.md", "a>b.md", "a%b.md", "a\nb.md", "a\rb.md"]) {
|
|
assert.equal(isSafeFilename(bad), false, `should reject: ${JSON.stringify(bad)}`);
|
|
}
|
|
});
|
|
|
|
test("isSafeFilename rejects the cmd.exe escape character and control characters", () => {
|
|
// `^` escapes the next character in cmd.exe, so it can defuse the closing
|
|
// quote. NUL additionally makes spawn() throw synchronously.
|
|
for (const bad of ["a^b.md", "a\u0000b.md", "a\u001bb.md", "a\u007fb.md"]) {
|
|
assert.equal(isSafeFilename(bad), false, `should reject: ${JSON.stringify(bad)}`);
|
|
}
|
|
});
|
|
|
|
test("isSafeFilename rejects path traversal", () => {
|
|
assert.equal(isSafeFilename("../secrets.md"), false);
|
|
assert.equal(isSafeFilename("a/../../b.md"), false);
|
|
});
|
|
|
|
test("isSafeFilename rejects empty and non-string input", () => {
|
|
assert.equal(isSafeFilename(""), false);
|
|
assert.equal(isSafeFilename(null), false);
|
|
assert.equal(isSafeFilename(undefined), false);
|
|
assert.equal(isSafeFilename(42), false);
|
|
});
|