2 Commits

Include renames

Author	SHA1	Message	Date
SnapOtter	ac8c585beb	fix: percent-encode X-File-Results header to support non-ASCII filenames ... The X-File-Results header contained raw JSON with non-ASCII characters from filenames (Chinese, Japanese, etc.), violating RFC 7230. Node.js threw ERR_INVALID_CHAR on writeHead(). Fixed by wrapping the JSON in encodeURIComponent() on the backend and decodeURIComponent() on the frontend, ensuring only ASCII goes into the header while preserving the original filenames after decoding. Closes #133	2026-05-12 23:19:20 +08:00
SnapOtter	41455f98bd	test: add path traversal, null-byte, unicode, and concurrent request tests ... New adversarial-security.test.ts covering 28 security-focused test cases: - Path traversal attacks (7): Unix, Windows-style, URL-encoded, double-encoded, embedded - Null byte injection (4): before extension, embedded, null-only, combined with traversal - Extreme filename lengths (5): 1000-char, 5000-char, special-char-only, spaces, repeated dots - Unicode filenames (8): Arabic RTL, Korean, Devanagari, complex emoji, RTLO char, ZWJ, tabs - Concurrent request racing (4): 10 simultaneous with integrity check, batch+single isolation, 10 across 5 tools, adversarial+valid mixed - Server stability (1): post-barrage health verification No real vulnerabilities found -- sanitizeFilename() in lib/filename.ts properly handles all tested attack vectors via basename(), dot-dot stripping, and null byte removal.	2026-05-01 02:29:20 +08:00