Fix dependency CVEs and provide shared PR base #173

Merged
Twyco merged 3 commits from fix/dependency-cves into main 2026-09-30 10:07:54 +00:00
2 changed files with 0 additions and 40 deletions
Showing only changes of commit 1a022c257f - Show all commits
-1
View File
@@ -9,7 +9,6 @@ on:
pull_request:
branches:
- main
- fix/dependency-cves
permissions:
contents: read
-39
View File
@@ -1,39 +0,0 @@
<?php
namespace Tests\Unit;
use League\Flysystem\CorruptedPathDetected;
use League\Flysystem\WhitespacePathNormalizer;
use PHPUnit\Framework\Attributes\DataProvider;
use PHPUnit\Framework\TestCase;
class FilesystemPathSecurityTest extends TestCase
{
#[DataProvider('corruptedPaths')]
public function test_corrupted_paths_are_rejected(string $path): void
{
$this->expectException(CorruptedPathDetected::class);
(new WhitespacePathNormalizer)->normalizePath($path);
}
/**
* @return array<string, array{string}>
*/
public static function corruptedPaths(): array
{
return [
'control character' => ["avatars/user\x00.svg"],
'malformed UTF-8' => ["avatars/user\xFF.svg"],
'control character hidden by malformed UTF-8' => ["avatars/user\xFF\x00.svg"],
];
}
public function test_valid_unicode_paths_remain_supported(): void
{
$this->assertSame(
'avatars/benützer.svg',
(new WhitespacePathNormalizer)->normalizePath('./avatars//benützer.svg'),
);
}
}