german/houseplan-card
1
0
Fork 0
mirror of https://github.com/Matysh/houseplan-card synced 2026-07-31 08:28:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tests: entry auto-loads after the config flow; traversal assertion checks path segments, not substrings

Browse Source
This commit is contained in:
Matysh
2026-07-06 00:35:36 +03:00
parent 290b107c49
commit a4b3a4a83f
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests_backend/test_ha_upload.py
+5 -2
View File
@@ -53,5 +53,8 @@ async def test_upload_traversal_sanitized(hass: HomeAssistant, hass_client: Clie
resp = await client.post("/api/houseplan/upload", data=fd)
assert resp.status == 200
body = await resp.json()
# both the marker dir and the filename must be flattened to safe names
assert ".." not in body["url"]
# both the marker dir and the filename must be flattened to safe names:
# no path segment may be exactly ".." (dots inside a name are harmless)
path = body["url"].split("?", 1)[0]
assert all(seg != ".." for seg in path.split("/"))
assert path.startswith("/houseplan_files/files/")