













@@ -29,6 +29,7 @@ let writeBase64ToFile: typeof import("./nodes-camera.js").writeBase64ToFile;
2929let writeUrlToFile: typeof import("./nodes-camera.js").writeUrlToFile;
3030let parseScreenRecordPayload: typeof import("./nodes-screen.js").parseScreenRecordPayload;
3131let screenRecordTempPath: typeof import("./nodes-screen.js").screenRecordTempPath;
32+let writeScreenRecordToFile: typeof import("./nodes-screen.js").writeScreenRecordToFile;
32333334async function withCameraTempDir<T>(run: (dir: string) => Promise<T>): Promise<T> {
3435return await withTempDir("openclaw-test-", run);
@@ -54,7 +55,8 @@ describe("nodes camera helpers", () => {
5455 writeBase64ToFile,
5556 writeUrlToFile,
5657} = await import("./nodes-camera.js"));
57-({ parseScreenRecordPayload, screenRecordTempPath } = await import("./nodes-screen.js"));
58+({ parseScreenRecordPayload, screenRecordTempPath, writeScreenRecordToFile } =
59+await import("./nodes-screen.js"));
5860});
59616062beforeEach(() => {
@@ -111,6 +113,24 @@ describe("nodes camera helpers", () => {
111113expect(p).toBe(path.join("/tmp", "openclaw-camera-snap-front-id1.jpg"));
112114});
113115116+it("rejects media format path traversal", () => {
117+expect(() =>
118+cameraTempPath({
119+kind: "snap",
120+ext: "../escaped",
121+tmpDir: "/tmp",
122+id: "id1",
123+}),
124+).toThrow(/invalid media format/i);
125+expect(() =>
126+screenRecordTempPath({
127+ext: "mp4/../../escaped",
128+tmpDir: "/tmp",
129+id: "id1",
130+}),
131+).toThrow(/invalid media format/i);
132+});
133+114134it("writes camera clip payload to temp path", async () => {
115135await withCameraTempDir(async (dir) => {
116136const out = await writeCameraClipPayloadToFile({
@@ -173,6 +193,18 @@ describe("nodes camera helpers", () => {
173193});
174194});
175195196+it("rejects oversized base64 payloads before writing", async () => {
197+await withCameraTempDir(async (dir) => {
198+const out = path.join(dir, "x.bin");
199+await expect(writeBase64ToFile(out, "aGk=", { maxBytes: 1 })).rejects.toThrow(/exceeds max/i);
200+await expectPathMissing(out);
201+await expect(writeScreenRecordToFile(out, "aGk=", { maxBytes: 1 })).rejects.toThrow(
202+/exceeds max/i,
203+);
204+await expectPathMissing(out);
205+});
206+});
207+176208afterEach(() => {
177209vi.unstubAllGlobals();
178210});
此內容由慣性聚合(RSS閱讀器)自動聚合整理,僅供閱讀參考。 原文來自 — 版權歸原作者所有。