Commit graph

2 commits

Author SHA1 Message Date
Kelsi
d03c96e3bd test(wcp): add unpack security tests
6 tests covering ContentPacker::unpackZone defenses:
- absurd fileCount header rejected
- absurd infoSize header rejected (16MB cap)
- relative path traversal ('../../etc/passwd_clone') rejected
- absolute paths ('/tmp/...') rejected
- malicious zone name slugified instead of escaping destDir
- bad magic rejected

Each test confirms the defense fires AND that no escape file
landed outside the test dir.
2026-05-06 08:03:02 -07:00
Kelsi
ad65b2ad36 test(editor): add 4 quest validateChains tests + rename to test_editor_units
Tests cover:
- non-existent nextQuestId is flagged
- orphan quests (no questgiver, no turn-in) are flagged
- turn-in only quest is accepted (auto-completed quest pattern)
- circular chain is detected

Renamed test_sql_escape → test_editor_units since the file now
houses both SQL escape and quest validation tests.
2026-05-06 07:49:26 -07:00