From 0244976f8d34954d2621d142d8777a7926388a50 Mon Sep 17 00:00:00 2001 From: Gracy769 <169199616+Gracy769@users.noreply.github.com> Date: Mon, 7 Sep 2026 07:22:52 +0530 Subject: [PATCH] test: add explicit coverage for unquoted UNC paths Asserts that an unquoted UNC path like \\server\share\file.txt survives extract_path_candidates unchanged, preventing the regression where shlex.split(posix=True) stripped the backslashes. --- tests/test_security_scope.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/tests/test_security_scope.py b/tests/test_security_scope.py index 8bea608a..56430a3b 100644 --- a/tests/test_security_scope.py +++ b/tests/test_security_scope.py @@ -299,12 +299,17 @@ class WorkspacePathScopeTests(unittest.TestCase): local_workspace.mkdir() # 1. Test extraction of escaped UNC paths (like from JSON payloads) - payload = r'type \\\\server\\share\\secret.txt' - candidates = extract_path_candidates(payload) - self.assertIn(r'\\\\server\\share\\secret.txt', candidates) + payload_escaped = r'type \\\\server\\share\\secret.txt' + candidates_escaped = extract_path_candidates(payload_escaped) + self.assertIn(r'\\\\server\\share\\secret.txt', candidates_escaped) + + # 1b. Test extraction of unquoted UNC paths to ensure they survive shlex.split(posix=True) + payload_unquoted = r'type \\server\share\secret.txt' + candidates_unquoted = extract_path_candidates(payload_unquoted) + self.assertIn(r'\\server\share\secret.txt', candidates_unquoted) # 2. Test denial of UNC path when workspace is on a local drive - decision_outside = WorkspacePathScope.from_root(local_workspace).validate_payload(payload) + decision_outside = WorkspacePathScope.from_root(local_workspace).validate_payload(payload_escaped) self.assertFalse(decision_outside.allowed) # 3. Test allowance of UNC path when workspace root is itself a UNC path