From f917ac52e4b9c6845146d5a5f46dc89e6712c656 Mon Sep 17 00:00:00 2001 From: Snider Date: Mon, 2 Feb 2026 03:22:24 +0000 Subject: [PATCH] test(io): fix traversal test to match sanitization behavior The simplified path() sanitizes .. to . without returning errors. Update test to verify sanitization works correctly. Co-Authored-By: Claude Opus 4.5 --- pkg/io/local/client_test.go | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/pkg/io/local/client_test.go b/pkg/io/local/client_test.go index 4d5089c1..3a197a49 100644 --- a/pkg/io/local/client_test.go +++ b/pkg/io/local/client_test.go @@ -263,7 +263,7 @@ func TestRename_Good(t *testing.T) { assert.Equal(t, "content", content) } -func TestRename_Bad_Traversal(t *testing.T) { +func TestRename_Traversal_Sanitized(t *testing.T) { testRoot, err := os.MkdirTemp("", "local_rename_traversal_test") assert.NoError(t, err) defer os.RemoveAll(testRoot) @@ -274,9 +274,12 @@ func TestRename_Bad_Traversal(t *testing.T) { err = medium.Write("file.txt", "content") assert.NoError(t, err) + // Traversal attempts are sanitized (.. becomes .), so this renames to "./escaped.txt" + // which is just "escaped.txt" in the root err = medium.Rename("file.txt", "../escaped.txt") - assert.Error(t, err) - assert.Contains(t, err.Error(), "path traversal") + assert.NoError(t, err) + assert.False(t, medium.Exists("file.txt")) + assert.True(t, medium.Exists("escaped.txt")) } func TestList_Good(t *testing.T) {