feat: launcher icons come from the configured icon theme

1 files changed, 14 insertions, 0 deletions

diff --git a/tests/test_server.py b/tests/test_server.py
index 3340398..1e942c2 100644
--- a/tests/test_server.py
+++ b/tests/test_server.py
@@ -91,6 +91,20 @@ class Server(unittest.TestCase):
         h = {**HOST, **ORIGIN, "Content-Type": "application/json"}
         self.assertEqual(self.req("POST", "/api/demo/boom", h, '{"x": null}')[0], 400)
 
+    def test_icons_route_rejects_traversal(self):
+        self.assertEqual(self.req("GET", "/icons/..%2Fconfig.toml", HOST)[0], 404)
+
+    def test_icon_path_resolves_and_rejects(self):
+        import tempfile
+        from pathlib import Path
+        base = Path(tempfile.mkdtemp())
+        d = base / "candy-icons" / "apps" / "scalable"
+        d.mkdir(parents=True)
+        (d / "obs.svg").write_text("<svg/>")
+        self.assertEqual(srv.icon_path("obs", "candy-icons", [base]), d / "obs.svg")
+        self.assertIsNone(srv.icon_path("../x", "candy-icons", [base]))
+        self.assertIsNone(srv.icon_path("nope", "candy-icons", [base]))
+
     def test_art_route(self):
         from unittest import mock
         with mock.patch.object(srv, "art", return_value=(b"PNGDATA", "image/png")):