 SnapOtter
|
41455f98bd
|
test: add path traversal, null-byte, unicode, and concurrent request tests
New adversarial-security.test.ts covering 28 security-focused test cases:
- Path traversal attacks (7): Unix, Windows-style, URL-encoded, double-encoded, embedded
- Null byte injection (4): before extension, embedded, null-only, combined with traversal
- Extreme filename lengths (5): 1000-char, 5000-char, special-char-only, spaces, repeated dots
- Unicode filenames (8): Arabic RTL, Korean, Devanagari, complex emoji, RTLO char, ZWJ, tabs
- Concurrent request racing (4): 10 simultaneous with integrity check, batch+single isolation,
10 across 5 tools, adversarial+valid mixed
- Server stability (1): post-barrage health verification
No real vulnerabilities found -- sanitizeFilename() in lib/filename.ts properly
handles all tested attack vectors via basename(), dot-dot stripping, and null
byte removal.
|
2026-05-01 02:29:20 +08:00 |
|