Skip to content

Fix path traversal detection on Windows in validateDestinationPath#2714

Open
ConnorQi01 wants to merge 2 commits into
masterfrom
dev/v-peq/fix-certificateProvider_pathTraversal
Open

Fix path traversal detection on Windows in validateDestinationPath#2714
ConnorQi01 wants to merge 2 commits into
masterfrom
dev/v-peq/fix-certificateProvider_pathTraversal

Conversation

@ConnorQi01

@ConnorQi01 ConnorQi01 commented Jun 12, 2026

Copy link
Copy Markdown
Collaborator

Summary

Two test failures on Windows caused by macOS-specific assumptions in the test suite.

Proposed Changes

Fix 1: validateDestinationPath path traversal detection (Closes #2713)

  • destination.split(/[\/]+/) fails to tokenize Windows backslash paths correctly — the entire path is returned as one token, so .. is never detected
  • Fix: use destination.split(path.sep) for platform-correct splitting

Fix 2: installPods enhanced environment test (Closes #2715)

  • Test uses : as PATH separator (macOS convention) and runs on all platforms
  • The feature itself already guards with os.platform() !== 'darwin'
  • Fix: skip the test on non-macOS with this.skip()

Test Plan

  • npm test: 218 passing, 0 failing, 1 pending (installPods skipped on Windows)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant