From edaad8e9f6e918c783fd8fb9237fa33032194ed5 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Mon, 9 Nov 2026 20:35:26 +0100 Subject: feat: launcher icons come from the configured icon theme --- tests/test_server.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'tests') diff --git a/tests/test_server.py b/tests/test_server.py index 3340398..1e942c2 100644 --- a/tests/test_server.py +++ b/tests/test_server.py @@ -91,6 +91,20 @@ class Server(unittest.TestCase): h = {**HOST, **ORIGIN, "Content-Type": "application/json"} self.assertEqual(self.req("POST", "/api/demo/boom", h, '{"x": null}')[0], 400) + def test_icons_route_rejects_traversal(self): + self.assertEqual(self.req("GET", "/icons/..%2Fconfig.toml", HOST)[0], 404) + + def test_icon_path_resolves_and_rejects(self): + import tempfile + from pathlib import Path + base = Path(tempfile.mkdtemp()) + d = base / "candy-icons" / "apps" / "scalable" + d.mkdir(parents=True) + (d / "obs.svg").write_text("") + self.assertEqual(srv.icon_path("obs", "candy-icons", [base]), d / "obs.svg") + self.assertIsNone(srv.icon_path("../x", "candy-icons", [base])) + self.assertIsNone(srv.icon_path("nope", "candy-icons", [base])) + def test_art_route(self): from unittest import mock with mock.patch.object(srv, "art", return_value=(b"PNGDATA", "image/png")): -- cgit v1.2.3