tests: entry auto-loads after the config flow; traversal assertion checks path segments, not substrings

tests_backend/test_ha_config_flow.py

@@ -46,8 +46,7 @@ async def test_options_flow(hass: HomeAssistant) -> None:
     )
     result = await hass.config_entries.flow.async_configure(result["flow_id"], user_input={})
     entry = hass.config_entries.async_entries(DOMAIN)[0]
-    await hass.config_entries.async_setup(entry.entry_id)
+    await hass.async_block_till_done()  # entry is auto-set-up after the flow
-    await hass.async_block_till_done()
 
     result = await hass.config_entries.options.async_init(entry.entry_id)
     assert result["type"] is FlowResultType.FORM

tests_backend/test_ha_upload.py

@@ -53,5 +53,8 @@ async def test_upload_traversal_sanitized(hass: HomeAssistant, hass_client: Clie
     resp = await client.post("/api/houseplan/upload", data=fd)
     assert resp.status == 200
     body = await resp.json()
-    # both the marker dir and the filename must be flattened to safe names
+    # both the marker dir and the filename must be flattened to safe names:
-    assert ".." not in body["url"]
+    # no path segment may be exactly ".." (dots inside a name are harmless)
+    path = body["url"].split("?", 1)[0]
+    assert all(seg != ".." for seg in path.split("/"))
+    assert path.startswith("/houseplan_files/files/")