markdown-converter/tests/security-path-handling.test.js

/**
 * Security: Path Traversal Prevention Test Suite
 * @version 4.3.0
 */

const path = require('path');

describe('Security: Path Handling', () => {
  describe('path traversal prevention', () => {
    it('should detect path traversal patterns', () => {
      const maliciousPaths = [
        '../etc/passwd',
        '../../sensitive',
        './../outside'
      ];

      maliciousPaths.forEach(pathStr => {
        // Path traversal attempts contain .. patterns
        expect(pathStr).toMatch(/\.\./);
      });
    });

    it('should normalize relative paths safely', () => {
      const safePaths = [
        './documents/file.md',
        'relative/path/file.txt'
      ];

      safePaths.forEach(pathStr => {
        const normalized = path.normalize(pathStr);
        // Safe relative paths should normalize cleanly
        expect(normalized).toBeDefined();
        expect(typeof normalized).toBe('string');
      });
    });

    it('should detect absolute paths', () => {
      const absolutePath = '/etc/passwd';
      const isAbsolute = path.isAbsolute(absolutePath);
      
      // Linux/Mac: /path is absolute
      if (process.platform !== 'win32') {
        expect(isAbsolute).toBe(true);
      }
    });

    it('should safely join paths with base directory', () => {
      const baseDir = '/safe/base/directory';
      const userInput = 'documents/file.md';
      
      const joined = path.join(baseDir, userInput);
      
      // Result should contain the safe base
      expect(joined).toContain('base');
      expect(joined).toContain('documents');
    });
  });

  describe('filename safety', () => {
    it('should identify safe filenames', () => {
      const safeNames = [
        'document.md',
        'my-file.txt',
        'file_name.pdf',
        'report_2026_04_24.xlsx'
      ];

      safeNames.forEach(name => {
        // Safe names should not contain path separators or null bytes
        const isSafe = !/[\\/\0]/.test(name) && name.length > 0;
        expect(isSafe).toBe(true);
      });
    });

    it('should flag filenames with path separators', () => {
      const problematicNames = [
        'file/with/slashes.txt',
        'file\\with\\backslashes.txt'
      ];

      problematicNames.forEach(name => {
        // These contain path separators and should be flagged
        const hasPathSeparators = /[\\/]/.test(name);
        expect(hasPathSeparators).toBe(true);
      });
    });

    it('should enforce minimum filename length', () => {
      const emptyName = '';
      
      expect(emptyName.length).toBe(0);
      expect(emptyName.length > 0).toBe(false);
    });
  });

  describe('validation patterns', () => {
    it('should validate path existence check pattern', () => {
      const validationPattern = /^[a-zA-Z0-9._\-/]+$/;
      
      const validPaths = ['documents/file.md', 'folder_2026/data.csv'];
      validPaths.forEach(pathStr => {
        // These should match a reasonable filename pattern
        expect(typeof pathStr).toBe('string');
      });
    });

    it('should prevent null byte injection', () => {
      const pathWithNullByte = 'file.txt\0.exe';
      
      const isSafe = !pathWithNullByte.includes('\0');
      expect(isSafe).toBe(false); // Has null byte, not safe
    });
  });
});