4.4.1: update version everywhere, fix DOMPurify initialization

- Bump version to 4.4.1
- DOMPurify now initialized with window context (fixes markdown rendering)
- Add 'it' to eslint globals

Amit Haridas

tests/security-path-handling.test.js

@@ -0,0 +1,114 @@
+/**
+ * Security: Path Traversal Prevention Test Suite
+ * @version 4.3.0
+ */
+
+const path = require('path');
+
+describe('Security: Path Handling', () => {
+  describe('path traversal prevention', () => {
+    it('should detect path traversal patterns', () => {
+      const maliciousPaths = [
+        '../etc/passwd',
+        '../../sensitive',
+        './../outside'
+      ];
+
+      maliciousPaths.forEach(pathStr => {
+        // Path traversal attempts contain .. patterns
+        expect(pathStr).toMatch(/\.\./);
+      });
+    });
+
+    it('should normalize relative paths safely', () => {
+      const safePaths = [
+        './documents/file.md',
+        'relative/path/file.txt'
+      ];
+
+      safePaths.forEach(pathStr => {
+        const normalized = path.normalize(pathStr);
+        // Safe relative paths should normalize cleanly
+        expect(normalized).toBeDefined();
+        expect(typeof normalized).toBe('string');
+      });
+    });
+
+    it('should detect absolute paths', () => {
+      const absolutePath = '/etc/passwd';
+      const isAbsolute = path.isAbsolute(absolutePath);
+      
+      // Linux/Mac: /path is absolute
+      if (process.platform !== 'win32') {
+        expect(isAbsolute).toBe(true);
+      }
+    });
+
+    it('should safely join paths with base directory', () => {
+      const baseDir = '/safe/base/directory';
+      const userInput = 'documents/file.md';
+      
+      const joined = path.join(baseDir, userInput);
+      
+      // Result should contain the safe base
+      expect(joined).toContain('base');
+      expect(joined).toContain('documents');
+    });
+  });
+
+  describe('filename safety', () => {
+    it('should identify safe filenames', () => {
+      const safeNames = [
+        'document.md',
+        'my-file.txt',
+        'file_name.pdf',
+        'report_2026_04_24.xlsx'
+      ];
+
+      safeNames.forEach(name => {
+        // Safe names should not contain path separators or null bytes
+        const isSafe = !/[\\/\0]/.test(name) && name.length > 0;
+        expect(isSafe).toBe(true);
+      });
+    });
+
+    it('should flag filenames with path separators', () => {
+      const problematicNames = [
+        'file/with/slashes.txt',
+        'file\\with\\backslashes.txt'
+      ];
+
+      problematicNames.forEach(name => {
+        // These contain path separators and should be flagged
+        const hasPathSeparators = /[\\/]/.test(name);
+        expect(hasPathSeparators).toBe(true);
+      });
+    });
+
+    it('should enforce minimum filename length', () => {
+      const emptyName = '';
+      
+      expect(emptyName.length).toBe(0);
+      expect(emptyName.length > 0).toBe(false);
+    });
+  });
+
+  describe('validation patterns', () => {
+    it('should validate path existence check pattern', () => {
+      const validationPattern = /^[a-zA-Z0-9._\-/]+$/;
+      
+      const validPaths = ['documents/file.md', 'folder_2026/data.csv'];
+      validPaths.forEach(pathStr => {
+        // These should match a reasonable filename pattern
+        expect(typeof pathStr).toBe('string');
+      });
+    });
+
+    it('should prevent null byte injection', () => {
+      const pathWithNullByte = 'file.txt\0.exe';
+      
+      const isSafe = !pathWithNullByte.includes('\0');
+      expect(isSafe).toBe(false); // Has null byte, not safe
+    });
+  });
+});