hyper-note / test / unit / path-traversal.test.js

import test from 'brittle'
import { NoteManager } from '../../lib/note-manager.js'
import { MediaService } from '../../lib/services/media-service.js'

const TRAVERSALS = ['../notes/secret', 'a/../../x', 'foo/bar', 'x\\y', '..', 'a\0b', '']

test('getNote rejects path-traversal noteIds before any storage access', async (t) => {
  const trap = () => { throw new Error('storage touched — traversal guard failed') }
  const nm = new NoteManager({ getDrive: trap })
  nm._getSharedNotebook = trap // must not be reached for malicious input

  for (const bad of TRAVERSALS) {
    t.is(await nm.getNote('nb', bad), null, `rejected noteId ${JSON.stringify(bad)}`)
  }

  clearInterval(nm._keyCacheCleanupInterval) // release the key-cache timer
})

test('MediaService.resolve rejects path-traversal identifiers before any storage access', async (t) => {
  const trap = new Proxy({}, { get () { throw new Error('storage touched — traversal guard failed') } })
  const ms = new MediaService({ mediaStore: trap, driveManager: trap, noteManager: trap })

  for (const bad of TRAVERSALS) {
    t.is(await ms.resolve('nb', bad), null, `rejected identifier ${JSON.stringify(bad)}`)
  }
})