a7a1595cbf
- make quick/check/mutation from cj/security-baseline (Makefile unchanged, settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint security rules, Forgejo workflow - tests/security: generic baseline tests plus app config and role tests against createApp() with an in-memory database - extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests - fix gaps found by the tests: reject unknown fields on project create, answer malformed JSON with 400 instead of 500, set nosniff on the API - npm audit fix (next 16.4.1 and others, no high/critical left) - clear ESLint errors, safeFileName without control-character regex - per-project ownership stays an open, documented gap (idorGap -> TODO) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
21 lines
875 B
TypeScript
21 lines
875 B
TypeScript
import assert from "node:assert/strict";
|
|
import { describe, it } from "node:test";
|
|
import { safeFileName } from "../src/server/controllers/external-return-workbook.controller.js";
|
|
|
|
// Regression for the regex-free rewrite (ESLint no-control-regex): same output as the
|
|
// former /[<>:"/\\|?*\u0000-\u001f]/g replacement.
|
|
describe("safeFileName", () => {
|
|
it("replaces Windows-forbidden characters", () => {
|
|
assert.equal(safeFileName('a<b>c:d"e/f\\g|h?i*j'), "a_b_c_d_e_f_g_h_i_j");
|
|
});
|
|
|
|
it("replaces ASCII control characters but keeps umlauts and spaces", () => {
|
|
assert.equal(safeFileName("Büro\u0000 Nord\u001f\t"), "Büro_ Nord_");
|
|
assert.equal(safeFileName("x\u007fy"), "x\u007fy");
|
|
});
|
|
|
|
it("trims and falls back to Projekt", () => {
|
|
assert.equal(safeFileName(" Haus A "), "Haus A");
|
|
assert.equal(safeFileName(" "), "Projekt");
|
|
});
|
|
});
|