fix: close input normalization aliases

2026-09-02 00:44:38 +03:00
parent 0a34f90bb9
commit 6428b5dcd6
4 changed files with 26 additions and 3 deletions
--- a/tests/unit/production-inputs.test.ts
+++ b/tests/unit/production-inputs.test.ts
@@ -80,4 +80,17 @@ describe('production inputs', () => {
      expect(() => assetUrl(manifest, 'selected-build-one', base)).toThrow(/asset url base/i);
    }
  });
+
+  it('rejects raw C0 controls and DEL in an asset URL base before URL parsing', () => {
+    const manifest = parsePublicAssetManifest(JSON.parse(readFileSync(fixtureUrl('asset-manifest.valid.json'), 'utf8')));
+    for (const base of [
+      '/assets/\n../private/',
+      '/assets/\nprivate/',
+      '/assets/\tprivate/',
+      '/assets/\rprivate/',
+      '/assets/\u007fprivate/',
+    ]) {
+      expect(() => assetUrl(manifest, 'selected-build-one', base)).toThrow(/asset url base/i);
+    }
+  });
 });