github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-11 07:14:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: use & instead of <> in XML escaping test for Windows NTFS compatibility (#3750)

Browse Source 
NTFS does not allow < or > in filenames, causing the XML filename
escaping test to fail on Windows CI with ENOENT.

Replace file<test>.txt with file&test.txt — & is valid on all platforms
and still requires XML escaping (&amp;), preserving the test's intent.

Fixes #3748
This commit is contained in:
Conroy Whitney
2026-01-29 00:46:50 -05:00
committed by GitHub
parent 0761652701
commit c20035094d
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/media-understanding/apply.test.ts
View File

@@ -550,10 +550,11 @@ describe("applyMediaUnderstanding", () => {
it("escapes XML special characters in filenames to prevent injection", async () => { it("escapes XML special characters in filenames to prevent injection", async () => {
const { applyMediaUnderstanding } = await loadApply(); const { applyMediaUnderstanding } = await loadApply();
const dir = await fs.mkdtemp(path.join(os.tmpdir(), "moltbot-media-")); const dir = await fs.mkdtemp(path.join(os.tmpdir(), "moltbot-media-"));
// Create file with XML special characters in the name (what filesystem allows) // Use & in filename — valid on all platforms (including Windows, which
// forbids < and > in NTFS filenames) and still requires XML escaping.
// Note: The sanitizeFilename in store.ts would strip most dangerous chars, // Note: The sanitizeFilename in store.ts would strip most dangerous chars,
// but we test that even if some slip through, they get escaped in output // but we test that even if some slip through, they get escaped in output
const filePath = path.join(dir, "file<test>.txt"); const filePath = path.join(dir, "file&test.txt");
await fs.writeFile(filePath, "safe content"); await fs.writeFile(filePath, "safe content");
const ctx: MsgContext = { const ctx: MsgContext = {
@@ -575,10 +576,9 @@ describe("applyMediaUnderstanding", () => {
expect(result.appliedFile).toBe(true); expect(result.appliedFile).toBe(true);
// Verify XML special chars are escaped in the output // Verify XML special chars are escaped in the output
expect(ctx.Body).toContain("&lt;"); expect(ctx.Body).toContain("&amp;");
expect(ctx.Body).toContain("&gt;"); // The name attribute should contain the escaped form, not a raw unescaped &
// The raw < and > should not appear unescaped in the name attribute expect(ctx.Body).toMatch(/name="file&amp;test\.txt"/);
expect(ctx.Body).not.toMatch(/name="[^"]*<[^"]*"/);
}); });
it("normalizes MIME types to prevent attribute injection", async () => { it("normalizes MIME types to prevent attribute injection", async () => {