@@ -480,7 +480,7 @@ mod tests {
480480 assert ! ( validate_session_id( "abc-123" ) ) ;
481481 assert ! ( validate_session_id( "test_session" ) ) ;
482482 assert ! ( validate_session_id( "ABC123" ) ) ;
483-
483+
484484 // Invalid IDs - path traversal attempts
485485 assert ! ( !validate_session_id( "../../../etc" ) ) ;
486486 assert ! ( !validate_session_id( ".." ) ) ;
@@ -494,7 +494,7 @@ mod tests {
494494 // Normal ID stays the same
495495 assert_eq ! ( sanitize_session_id( "abc-123" ) , "abc-123" ) ;
496496 assert_eq ! ( sanitize_session_id( "test_session" ) , "test_session" ) ;
497-
497+
498498 // Path traversal gets sanitized
499499 assert_eq ! ( sanitize_session_id( "../../../etc" ) , "________etc" ) ;
500500 assert_eq ! ( sanitize_session_id( "test/subdir" ) , "test_subdir" ) ;
@@ -505,11 +505,11 @@ mod tests {
505505 fn test_session_dir_path_traversal ( ) {
506506 let ( storage, temp) = create_test_storage ( ) ;
507507 let base_dir = temp. path ( ) . to_path_buf ( ) ;
508-
508+
509509 // Attempt path traversal - should be sanitized
510510 let malicious_id = "../../../etc/passwd" ;
511511 let result_path = storage. session_dir ( malicious_id) ;
512-
512+
513513 // The result should still be under base_dir, not escaping it
514514 assert ! ( result_path. starts_with( & base_dir) ) ;
515515 assert ! ( !result_path. to_string_lossy( ) . contains( ".." ) ) ;
0 commit comments