@@ -1,5 +1,9 @@
11import { describe, expect, it } from "vitest";
2-import { parseCanvasSnapshotPayload } from "./cli-helpers.js";
2+import {
3+canvasSnapshotTempPath,
4+normalizeCanvasSnapshotFileExtension,
5+parseCanvasSnapshotPayload,
6+} from "./cli-helpers.js";
3748describe("canvas CLI helpers", () => {
59it("parses canvas.snapshot payload", () => {
@@ -14,4 +18,45 @@ describe("canvas CLI helpers", () => {
1418/invalid canvas\.snapshot payload/i,
1519);
1620});
21+22+it.each([{ base64: "aGk=" }, { format: 42, base64: "aGk=" }])(
23+"rejects invalid canvas.snapshot format fields",
24+(payload) => {
25+expect(() => parseCanvasSnapshotPayload(payload)).toThrow(
26+/invalid canvas\.snapshot payload/i,
27+);
28+},
29+);
30+31+it.each(["/../../target.sh", "../target.sh", "png/../../target.sh", "image/png", ""])(
32+"rejects unsafe canvas.snapshot formats from responses: %s",
33+(format) => {
34+expect(() => parseCanvasSnapshotPayload({ format, base64: "aGk=" })).toThrow(
35+/invalid canvas\.snapshot payload/i,
36+);
37+},
38+);
39+40+it("normalizes supported snapshot file extensions", () => {
41+expect(normalizeCanvasSnapshotFileExtension("png")).toBe("png");
42+expect(normalizeCanvasSnapshotFileExtension(".jpeg")).toBe("jpg");
43+expect(normalizeCanvasSnapshotFileExtension(" JPG ")).toBe("jpg");
44+});
45+46+it("rejects unsafe snapshot temp path parts", () => {
47+expect(() =>
48+canvasSnapshotTempPath({
49+tmpDir: "/tmp/openclaw-canvas-test",
50+id: "snapshot",
51+ext: "/../../target.sh",
52+}),
53+).toThrow(/invalid canvas\.snapshot format/i);
54+expect(() =>
55+canvasSnapshotTempPath({
56+tmpDir: "/tmp/openclaw-canvas-test",
57+id: "../../snapshot",
58+ext: "png",
59+}),
60+).toThrow(/invalid canvas snapshot id/i);
61+});
1762});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。