import { describe, it, expect } from 'vitest' import { isSafeFilenameTemplate, isSafeOutputDir, isValidHistoryEntry, isValidErrorLogEntry, isTemplateLike } from '../src/main/validation' import type { HistoryEntry, ErrorLogEntry } from '@shared/ipc' // --- S4: filename template path-traversal ----------------------------------- describe('isSafeFilenameTemplate', () => { it('accepts the default template', () => { expect(isSafeFilenameTemplate('%(title)s.%(ext)s')).toBe(true) }) it('accepts sub-folder templates with yt-dlp fields', () => { expect(isSafeFilenameTemplate('%(uploader)s/%(title)s.%(ext)s')).toBe(true) expect(isSafeFilenameTemplate('%(uploader)s\\%(title)s.%(ext)s')).toBe(true) }) it('rejects forward-slash traversal', () => { expect(isSafeFilenameTemplate('%(title)s/../../evil.%(ext)s')).toBe(false) }) it('rejects backslash traversal', () => { expect(isSafeFilenameTemplate('%(title)s\\..\\..\\win32.exe')).toBe(false) }) it('rejects a bare .. segment', () => { expect(isSafeFilenameTemplate('..')).toBe(false) }) it('rejects absolute paths', () => { expect(isSafeFilenameTemplate('C:\\Windows\\system32\\%(title)s')).toBe(false) expect(isSafeFilenameTemplate('/etc/%(title)s')).toBe(false) }) it('allows .. only when embedded in a longer segment (not a real traversal)', () => { // '..foo' / 'foo..bar' are filenames, not parent-dir references. expect(isSafeFilenameTemplate('my..video.%(ext)s')).toBe(true) }) }) // --- S4: output directory ---------------------------------------------------- describe('isSafeOutputDir', () => { it('accepts an empty string (resolves to OS Downloads)', () => { expect(isSafeOutputDir('')).toBe(true) }) it('accepts an absolute Windows path', () => { expect(isSafeOutputDir('C:\\Users\\me\\Downloads')).toBe(true) }) it('rejects a relative path', () => { expect(isSafeOutputDir('Downloads')).toBe(false) expect(isSafeOutputDir('..\\elsewhere')).toBe(false) }) }) // --- S5: persisted JSON entry validation ------------------------------------- const validHistory: HistoryEntry = { id: 'a', title: 'A video', url: 'https://example.com/v', kind: 'video', quality: '1080p', completedAt: 1700000000000 } describe('isValidHistoryEntry', () => { it('accepts a well-formed entry', () => { expect(isValidHistoryEntry(validHistory)).toBe(true) }) it('accepts optional string fields', () => { expect( isValidHistoryEntry({ ...validHistory, filePath: 'C:\\x.mp4', channel: 'ch', sizeLabel: '10 MB', thumbnail: 'https://x/y.jpg' }) ).toBe(true) }) it('rejects a wrong kind', () => { expect(isValidHistoryEntry({ ...validHistory, kind: 'image' })).toBe(false) }) it('rejects a missing required field', () => { const { url: _url, ...noUrl } = validHistory expect(isValidHistoryEntry(noUrl)).toBe(false) }) it('rejects a non-string filePath (e.g. injected number/object)', () => { expect(isValidHistoryEntry({ ...validHistory, filePath: 42 })).toBe(false) }) it('rejects non-objects', () => { expect(isValidHistoryEntry(null)).toBe(false) expect(isValidHistoryEntry('nope')).toBe(false) expect(isValidHistoryEntry(undefined)).toBe(false) }) }) const validError: ErrorLogEntry = { id: 'e', url: 'https://example.com/v', kind: 'audio', error: 'boom', occurredAt: 1700000000000 } describe('isValidErrorLogEntry', () => { it('accepts a well-formed entry', () => { expect(isValidErrorLogEntry(validError)).toBe(true) expect(isValidErrorLogEntry({ ...validError, title: 'optional' })).toBe(true) }) it('rejects a missing error message', () => { const { error: _error, ...noError } = validError expect(isValidErrorLogEntry(noError)).toBe(false) }) it('rejects a non-numeric occurredAt', () => { expect(isValidErrorLogEntry({ ...validError, occurredAt: 'yesterday' })).toBe(false) }) }) describe('isTemplateLike', () => { it('accepts an object with a string or numeric id', () => { expect(isTemplateLike({ id: 'x', name: 'n', args: '--foo' })).toBe(true) expect(isTemplateLike({ id: 1 })).toBe(true) }) it('rejects entries without an id', () => { expect(isTemplateLike({ name: 'n', args: '--foo' })).toBe(false) expect(isTemplateLike(null)).toBe(false) expect(isTemplateLike('str')).toBe(false) }) })