test/test-static.sgl

1(import (sigil test)

2 (sigil web static))

4;; ============================================================

5;; safe-path?

6;; ============================================================

8(test-group "safe-path?"

9 (test "simple filename is safe"

10 (assert-true (safe-path? "style.css")))

12 (test "nested path is safe"

13 (assert-true (safe-path? "css/style.css")))

15 (test "deeply nested path is safe"

16 (assert-true (safe-path? "assets/js/vendor/lib.js")))

18 (test ".. is unsafe"

19 (assert-false (safe-path? "..")))

21 (test "path with .. traversal is unsafe"

22 (assert-false (safe-path? "../etc/passwd")))

24 (test ". is unsafe"

25 (assert-false (safe-path? ".")))

27 (test "embedded .. traversal is unsafe"

28 (assert-false (safe-path? "css/../../etc/passwd")))

30 (test "double-dot in filename is safe"

31 (assert-true (safe-path? "file..backup.txt")))

33 (test "empty string is safe"

34 (assert-true (safe-path? ""))))

36(run-tests)