test: cover path traversal rejection

2026-09-21 20:51:25 +08:00
parent f99e735966
commit a3d7f095fc
1 changed files with 20 additions and 0 deletions
@@ -0,0 +1,20 @@
+package api
+
+import "testing"
+
+func TestUnsafePath(t *testing.T) {
+	cases := map[string]bool{
+		"../secret":     true,
+		"a/../secret":   true,
+		`..\\secret`:    true,
+		"%2e%2e/secret": false,
+		"secret":        false,
+		"a//b":          false,
+		"":              false,
+	}
+	for p, want := range cases {
+		if got := unsafePath(p); got != want {
+			t.Fatalf("unsafePath(%q)=%v, want %v", p, got, want)
+		}
+	}
+}