From a4b3a4a83f5533a7569e44dba230fdfdce8c7111 Mon Sep 17 00:00:00 2001 From: Matysh Date: Mon, 6 Jul 2026 00:35:36 +0300 Subject: [PATCH] tests: entry auto-loads after the config flow; traversal assertion checks path segments, not substrings --- tests_backend/test_ha_config_flow.py | 3 +-- tests_backend/test_ha_upload.py | 7 +++++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/tests_backend/test_ha_config_flow.py b/tests_backend/test_ha_config_flow.py index eae9b05..4fe2619 100644 --- a/tests_backend/test_ha_config_flow.py +++ b/tests_backend/test_ha_config_flow.py @@ -46,8 +46,7 @@ async def test_options_flow(hass: HomeAssistant) -> None: ) result = await hass.config_entries.flow.async_configure(result["flow_id"], user_input={}) entry = hass.config_entries.async_entries(DOMAIN)[0] - await hass.config_entries.async_setup(entry.entry_id) - await hass.async_block_till_done() + await hass.async_block_till_done() # entry is auto-set-up after the flow result = await hass.config_entries.options.async_init(entry.entry_id) assert result["type"] is FlowResultType.FORM diff --git a/tests_backend/test_ha_upload.py b/tests_backend/test_ha_upload.py index a53dfcb..acee95e 100644 --- a/tests_backend/test_ha_upload.py +++ b/tests_backend/test_ha_upload.py @@ -53,5 +53,8 @@ async def test_upload_traversal_sanitized(hass: HomeAssistant, hass_client: Clie resp = await client.post("/api/houseplan/upload", data=fd) assert resp.status == 200 body = await resp.json() - # both the marker dir and the filename must be flattened to safe names - assert ".." not in body["url"] + # both the marker dir and the filename must be flattened to safe names: + # no path segment may be exactly ".." (dots inside a name are harmless) + path = body["url"].split("?", 1)[0] + assert all(seg != ".." for seg in path.split("/")) + assert path.startswith("/houseplan_files/files/")