@@ -21,6 +21,7 @@ describe("serve-static security checks", () => {
2121 expect ( resolveFilePath ( rootDir , "/../package.json" ) ) . toBeNull ( ) ;
2222 expect ( resolveFilePath ( rootDir , "/..\\..\\secret.txt" ) ) . toBeNull ( ) ;
2323 expect ( resolveFilePath ( rootDir , "/%2e%2e/%2e%2e/secret.txt" ) ) . toBeNull ( ) ;
24+ expect ( resolveFilePath ( rootDir , "/C:/Windows/system32" ) ) . toBeNull ( ) ;
2425 } ) ;
2526
2627 test ( "blocks malformed and null-byte request paths" , ( ) => {
@@ -159,4 +160,32 @@ describe("serve-static integration", () => {
159160
160161 await new Promise ( ( resolve ) => cliServer . close ( resolve ) ) ;
161162 } ) ;
163+
164+ test ( "bootstraps using default dist folder when argv path is omitted" , async ( ) => {
165+ const originalCwd = process . cwd ( ) ;
166+ const tempCwd = fs . mkdtempSync ( path . join ( os . tmpdir ( ) , "toyrobot-cli-cwd-" ) ) ;
167+ const distDir = path . join ( tempCwd , "dist" ) ;
168+ fs . mkdirSync ( distDir , { recursive : true } ) ;
169+ fs . writeFileSync ( path . join ( distDir , "index.html" ) , "<h1>Default Dist</h1>" ) ;
170+
171+ const messages = [ ] ;
172+
173+ try {
174+ process . chdir ( tempCwd ) ;
175+ const cliServer = startServerFromCli (
176+ [ "node" , "serve-static.js" ] ,
177+ { PORT : "0" } ,
178+ ( msg ) => messages . push ( msg ) ,
179+ ) ;
180+ await new Promise ( ( resolve ) => cliServer . on ( "listening" , resolve ) ) ;
181+
182+ expect ( messages . some ( ( msg ) => msg . includes ( "Serving" ) ) ) . toBe ( true ) ;
183+ expect ( messages . some ( ( msg ) => msg . includes ( distDir ) ) ) . toBe ( true ) ;
184+
185+ await new Promise ( ( resolve ) => cliServer . close ( resolve ) ) ;
186+ } finally {
187+ process . chdir ( originalCwd ) ;
188+ fs . rmSync ( tempCwd , { recursive : true , force : true } ) ;
189+ }
190+ } ) ;
162191} ) ;
0 commit comments