Harden issue artifact metadata

2026-05-30 19:34:44 +00:00
parent 96d266109b
commit bbf77fcb69
6 changed files with 292 additions and 5 deletions
@@ -16,4 +16,26 @@ describe("attachmentArtifactWorkProductMetadataSchema", () => {
    expect(parsed.contentType).toBe("video/mp4");
    expect(parsed.downloadPath).toContain("download=1");
  });
+
+  it("rejects off-route or scriptable paths", () => {
+    const parsed = attachmentArtifactWorkProductMetadataSchema.safeParse({
+      attachmentId: "11111111-1111-4111-8111-111111111111",
+      contentType: "video/mp4",
+      byteSize: 1234,
+      contentPath: "https://evil.example/video.mp4",
+      openPath: "javascript:alert(1)",
+      downloadPath: "/api/attachments/11111111-1111-4111-8111-111111111111/content",
+      originalFilename: "demo.mp4",
+    });
+
+    expect(parsed.success).toBe(false);
+    if (parsed.success) {
+      throw new Error("Expected invalid attachment artifact metadata");
+    }
+    expect(parsed.error.issues.map((issue) => issue.path.join("."))).toEqual([
+      "contentPath",
+      "openPath",
+      "downloadPath",
+    ]);
+  });
 });