Merge pull request #131 from soulteary/test/fix-TestHandlerAPISavePathTraversal

test: fix TestHandlerAPISavePathTraversal

Author: soulteary

internal/configui/configui.go

@@ -293,7 +293,12 @@ func runSave(w http.ResponseWriter, r *http.Request, writeDir string) {
 		writeJSONError(w, http.StatusBadRequest, "invalid json: "+err.Error())
 		return
 	}
-	base := filepath.Base(strings.TrimSpace(req.Filename))
+	trimmed := strings.TrimSpace(req.Filename)
+	if strings.Contains(trimmed, "..") {
+		writeJSONError(w, http.StatusBadRequest, "invalid filename")
+		return
+	}
+	base := filepath.Base(trimmed)
 	if base == "" || base == "." {
 		writeJSONError(w, http.StatusBadRequest, "filename is required")
 		return

internal/configui/configui_test.go

@@ -403,16 +403,19 @@ func TestHandlerAPISavePathTraversal(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Handler: %v", err)
 	}
-	body := `{"filename":"../../../etc/passwd","content":"x"}`
+	// Use a unique name under a path traversal so we only fail if we created it (../etc/passwd exists on Unix)
+	traversalName := "webhook-path-traversal-" + filepath.Base(tmp) + ".yaml"
+	body := `{"filename":"../../../etc/` + traversalName + `","content":"x"}`
 	req := httptest.NewRequest(http.MethodPost, "http://test/api/save", bytes.NewReader([]byte(body)))
 	req.Header.Set("Content-Type", "application/json")
 	w := httptest.NewRecorder()
 	h.ServeHTTP(w, req)
 	if w.Code != http.StatusBadRequest {
 		t.Errorf("POST /api/save with path traversal: status %d, want 400", w.Code)
 	}
-	_, err = os.Stat(filepath.Join(tmp, "../../../etc/passwd"))
-	if err == nil {
+	// Resolve path: must not create file outside writeDir (this path would only exist if we had a bug)
+	targetPath := filepath.Clean(filepath.Join(tmp, "..", "..", "..", "etc", traversalName))
+	if _, err := os.Stat(targetPath); err == nil {
 		t.Error("path traversal must not create file outside writeDir")
 	}
 }