byrongamatos 49da3022cf fix(career): path-traversal guard on prepare; a cap test that actually tests the cap ... CodeRabbit again, and the first one is a real hole I put there. 1. PATH TRAVERSAL. sloppak.resolve_source_dir() does a bare `dlc_root / filename` with NO containment guard — so `../../x` walks straight out of the library, and my new endpoint handed it attacker-supplied filenames. Every filename now goes through _resolve_dlc_path first, the same check every other filename-bound handler applies. Pinned: `..`, backslash traversal, an absolute POSIX path and a Windows drive path are all refused, and nothing outside the library is unpacked. 2. THE CAP TEST WAS VACUOUS. It asserted `prepared == 0` against a fixture with no library — where the endpoint exits before extraction — so it passed whether or not MAX_GIG_SONGS existed. It now runs against a real library and asserts the endpoint CONSIDERED at most MAX_GIG_SONGS of the 82 it was handed. Verified to fail when the cap is removed. Same class of mistake as the notedetect gigBlock: a test that passes for the wrong reason. Worth saying out loud since it is twice in one day. 3. E702 — semicolon-joined statements in the new tests, split. 51 career tests; full suite green.		2026-07-15 00:31:07 +02:00
..
__init__.py	feat(career): career plugin — stars, venue tiers, pack downloads (career mode 2/3) (#907)	2026-07-12 22:39:19 +02:00
conftest.py	feat(career): gigs backend — propose a setlist, log the completed set (#954)	2026-07-14 01:26:23 +02:00
test_passports.py	Career v3: Gold tier — verified improv upgrades an earned badge (#960)	2026-07-14 11:26:36 +02:00
test_routes.py	fix(career): path-traversal guard on prepare; a cap test that actually tests the cap	2026-07-15 00:31:07 +02:00