markdown-converter/tests/security-path-handling.test.js

/**
 * Security: Path Traversal Prevention Test Suite
 * @version 4.3.0
 */

const path = require('path');

describe('Security: Path Handling', () => {
  describe('path traversal prevention', () => {
    it('should detect path traversal patterns', () => {
      const maliciousPaths = ['../etc/passwd', '../../sensitive', './../outside'];

      maliciousPaths.forEach((pathStr) => {
        // Path traversal attempts contain .. patterns
        expect(pathStr).toMatch(/\.\./);
      });
    });

    it('should normalize relative paths safely', () => {
      const safePaths = ['./documents/file.md', 'relative/path/file.txt'];

      safePaths.forEach((pathStr) => {
        const normalized = path.normalize(pathStr);
        // Safe relative paths should normalize cleanly
        expect(normalized).toBeDefined();
        expect(typeof normalized).toBe('string');
      });
    });

    it('should detect absolute paths', () => {
      const absolutePath = '/etc/passwd';
      const isAbsolute = path.isAbsolute(absolutePath);

      // Linux/Mac: /path is absolute
      if (process.platform !== 'win32') {
        expect(isAbsolute).toBe(true);
      }
    });

    it('should safely join paths with base directory', () => {
      const baseDir = '/safe/base/directory';
      const userInput = 'documents/file.md';

      const joined = path.join(baseDir, userInput);

      // Result should contain the safe base
      expect(joined).toContain('base');
      expect(joined).toContain('documents');
    });
  });

  describe('filename safety', () => {
    it('should identify safe filenames', () => {
      const safeNames = ['document.md', 'my-file.txt', 'file_name.pdf', 'report_2026_04_24.xlsx'];

      safeNames.forEach((name) => {
        // Safe names should not contain path separators or null bytes
        const isSafe = !/[\\/\0]/.test(name) && name.length > 0;
        expect(isSafe).toBe(true);
      });
    });

    it('should flag filenames with path separators', () => {
      const problematicNames = ['file/with/slashes.txt', 'file\\with\\backslashes.txt'];

      problematicNames.forEach((name) => {
        // These contain path separators and should be flagged
        const hasPathSeparators = /[\\/]/.test(name);
        expect(hasPathSeparators).toBe(true);
      });
    });

    it('should enforce minimum filename length', () => {
      const emptyName = '';

      expect(emptyName.length).toBe(0);
      expect(emptyName.length > 0).toBe(false);
    });
  });

  describe('validation patterns', () => {
    it('should validate path existence check pattern', () => {
      const validationPattern = /^[a-zA-Z0-9._\-/]+$/;

      const validPaths = ['documents/file.md', 'folder_2026/data.csv'];
      validPaths.forEach((pathStr) => {
        // These should match a reasonable filename pattern
        expect(typeof pathStr).toBe('string');
      });
    });

    it('should prevent null byte injection', () => {
      const pathWithNullByte = 'file.txt\0.exe';

      const isSafe = !pathWithNullByte.includes('\0');
      expect(isSafe).toBe(false); // Has null byte, not safe
    });
  });
});