8c278be941
- Tests caught 2 real bugs:
- Zod NaN bypass in orders/offers schemas (Number(v) || fallback)
- invoiceTotalWithVat using Number() on { toNumber() } objects
- 7 new test files covering auth, env, exchange rates, NAS paths,
schema NaN rejection, invoice VAT calculation, customer validation
- 45 tests passing, build clean
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
56 lines
1.8 KiB
TypeScript
56 lines
1.8 KiB
TypeScript
import { describe, it, expect } from "vitest";
|
|
import { NasFileManager } from "../services/nas-file-manager";
|
|
|
|
describe("NasFileManager path traversal", () => {
|
|
const nas = new NasFileManager();
|
|
|
|
describe("deleteItem", () => {
|
|
it("rejects empty path", async () => {
|
|
const result = await nas.deleteItem("PRJ-001", "");
|
|
expect(result).toContain("kořenovou složku");
|
|
});
|
|
|
|
it("rejects root path /", async () => {
|
|
const result = await nas.deleteItem("PRJ-001", "/");
|
|
expect(result).toContain("kořenovou složku");
|
|
});
|
|
|
|
it("rejects current directory .", async () => {
|
|
const result = await nas.deleteItem("PRJ-001", ".");
|
|
expect(result).toContain("kořenovou složku");
|
|
});
|
|
|
|
it("rejects current directory ./", async () => {
|
|
const result = await nas.deleteItem("PRJ-001", "./");
|
|
expect(result).toContain("kořenovou složku");
|
|
});
|
|
|
|
it("rejects path traversal ..", async () => {
|
|
const result = await nas.deleteItem("PRJ-001", "../etc/passwd");
|
|
expect(result).toContain("Neplatná cesta");
|
|
});
|
|
});
|
|
|
|
describe("moveItem", () => {
|
|
it("rejects empty fromPath", async () => {
|
|
const result = await nas.moveItem("PRJ-001", "", "dest");
|
|
expect(result).toContain("kořenovou složku");
|
|
});
|
|
|
|
it("rejects root fromPath /", async () => {
|
|
const result = await nas.moveItem("PRJ-001", "/", "dest");
|
|
expect(result).toContain("kořenovou složku");
|
|
});
|
|
|
|
it("rejects current directory .", async () => {
|
|
const result = await nas.moveItem("PRJ-001", ".", "dest");
|
|
expect(result).toContain("kořenovou složku");
|
|
});
|
|
|
|
it("rejects path traversal in fromPath", async () => {
|
|
const result = await nas.moveItem("PRJ-001", "../secret", "dest");
|
|
expect(result).toContain("Neplatná cesta");
|
|
});
|
|
});
|
|
});
|