Address review findings in verapdf test helpers

Fix jar tracker by-reference capture, throw from buildZipArchive instead
of Pest expect, add buildMaliciousZip, and dataset install zip-slip cases.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: jbagsik

packages/verapdf/tests/Helpers.php

@@ -27,7 +27,10 @@ function verapdfTempDir(string $prefix): string
 function buildZipArchive(string $zipPath, array $entries): void
 {
     $zip = new ZipArchive;
-    expect($zip->open($zipPath, ZipArchive::CREATE))->toBeTrue();
+
+    if ($zip->open($zipPath, ZipArchive::CREATE) !== true) {
+        throw new RuntimeException('Cannot create ZIP archive: '.$zipPath);
+    }
 
     foreach ($entries as $entry) {
         $zip->addFromString($entry['name'], $entry['content']);
@@ -55,6 +58,17 @@ function buildZipAt(string $prefix, array $entries): string
     return $zipPath;
 }
 
+function buildMaliciousZip(
+    string $prefix,
+    string $entryName,
+    string $content = 'pwned',
+    bool $symlink = false,
+): string {
+    return buildZipAt($prefix, [
+        ['name' => $entryName, 'content' => $content, 'symlink' => $symlink],
+    ]);
+}
+
 /**
  * @return array{path: string, bytes: string, sha256: string}
  */
@@ -135,7 +149,7 @@ function fakeJavaProcessTrackingJar(): array
 {
     $state = ['installerJarRan' => false];
 
-    Process::fake(function (PendingProcess $process) use ($state) {
+    Process::fake(function (PendingProcess $process) use (&$state) {
         $command = $process->command;
         if (is_array($command) && in_array('-jar', $command, true)) {
             $state['installerJarRan'] = true;

packages/verapdf/tests/Unit/InstallVeraPdfCommandTest.php

@@ -57,46 +57,36 @@
         ->and($jarTracker['installerJarRan'])->toBeFalse();
 });
 
-test('install aborts on zip-slip archive before running the installer', function (): void {
-    $installer = buildInstallerZipWithChecksum('cmd-slip', [
-        ['name' => '../evil.txt', 'content' => 'pwned'],
-    ]);
-
-    fakeInstallerDownload($installer['bytes'], $installer['sha256']);
-
-    $jarTracker = fakeJavaProcessTrackingJar();
+test('install aborts on zip-slip archive', function (bool $force, bool $seedExisting): void {
+    $base = $seedExisting ? seedCliInstallLayout() : (string) config('verapdf.base_path');
 
-    $this->artisan('verapdf:install')
-        ->expectsOutputToContain('unsafe ZIP entry')
-        ->assertFailed();
+    if ($seedExisting) {
+        file_put_contents($base.'/bin/cli-1.30.1.jar', 'existing-cli');
+    }
 
-    $base = (string) config('verapdf.base_path');
-    expect(is_file($base.'/verapdf'))->toBeFalse()
-        ->and($jarTracker['installerJarRan'])->toBeFalse();
-
-    File::delete($installer['path']);
-});
-
-test('install aborts on zip-slip with --force without wiping an existing install', function (): void {
-    $base = seedCliInstallLayout();
-    file_put_contents($base.'/bin/cli-1.30.1.jar', 'existing-cli');
-
-    $installer = buildInstallerZipWithChecksum('cmd-force-slip', [
+    $installer = buildInstallerZipWithChecksum('cmd-slip', [
         ['name' => '../evil.txt', 'content' => 'pwned'],
     ]);
 
     fakeInstallerDownload($installer['bytes'], $installer['sha256']);
 
     $jarTracker = fakeJavaProcessTrackingJar();
 
-    $this->artisan('verapdf:install', ['--force' => true])
-        ->expectsOutputToContain('unsafe ZIP entry')
-        ->assertFailed();
+    $command = $this->artisan('verapdf:install', $force ? ['--force' => true] : []);
+    $command->expectsOutputToContain('unsafe ZIP entry')->assertFailed();
 
-    expect(is_file($base.'/verapdf'))->toBeTrue()
-        ->and(is_file($base.'/bin/cli-1.30.1.jar'))->toBeTrue()
-        ->and((string) file_get_contents($base.'/bin/cli-1.30.1.jar'))->toBe('existing-cli')
-        ->and($jarTracker['installerJarRan'])->toBeFalse();
+    if ($seedExisting) {
+        expect(is_file($base.'/verapdf'))->toBeTrue()
+            ->and(is_file($base.'/bin/cli-1.30.1.jar'))->toBeTrue()
+            ->and((string) file_get_contents($base.'/bin/cli-1.30.1.jar'))->toBe('existing-cli');
+    } else {
+        expect(is_file($base.'/verapdf'))->toBeFalse();
+    }
+
+    expect($jarTracker['installerJarRan'])->toBeFalse();
 
     File::delete($installer['path']);
-});
+})->with([
+    'before running the installer' => [false, false],
+    'with --force without wiping an existing install' => [true, true],
+]);