mirror of
https://github.com/HeyPuter/puter.git
synced 2026-08-24 15:07:17 +00:00
test(share): assert the masked share path by its exact shape
The substring check tripped on the scratch files' own names, which start with `sharing-`; the exact-equality assertion on `/<owner>/<uid>/<name>` already proves nothing above the share leaks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
co-authored by
Claude Fable 5
parent
9195896ab5
commit
17d7a9d333
@@ -142,12 +142,12 @@ export default suite('sharing', {
|
||||
);
|
||||
t.assert.ok(listed && shared, 'the share should be listed');
|
||||
|
||||
// The owner's folder is not in it, but the backend still resolves it.
|
||||
t.assert.ok(
|
||||
!shared!.path.includes('/sharing-'),
|
||||
`path should be masked, got ${shared!.path}`,
|
||||
// The exact masked shape: owner, entry uid, leaf name — and nothing
|
||||
// of the owner's tree between them. The backend still resolves it.
|
||||
t.assert.equal(
|
||||
shared!.path,
|
||||
`${home(t)}/${shared!.uid_entry}/${shared!.name}`,
|
||||
);
|
||||
t.assert.equal(shared!.path, `${home(t)}/${shared!.uid_entry}/${shared!.name}`);
|
||||
|
||||
const read = await fetch(
|
||||
`${t.env.apiOrigin}/read?${new URLSearchParams({ file: shared!.path })}`,
|
||||
|
||||
Reference in New Issue
Block a user