lesson-slugify-path-traversal-deep-coverage.json

{
  "task_id": "lesson-slugify-path-traversal-deep-coverage",
  "title": "Slugify: deep coverage of path traversal, null bytes, and reserved names",
  "domain": "scripts",
  "tags": [
    "slugify",
    "path-traversal",
    "windows-reserved",
    "null-byte",
    "test-coverage"
  ],
  "problem": "The original 5-test `test_slugify.py` (merged in commit `6912f87` for issue #95) covered the basics: standard titles, slashes, emojis, reserved names, and length limits. But it did NOT explicitly verify the new task acceptance criteria for issue #95 (re-posted as EvoMap bounty `cmptjhjjg4ood7i2bkhkov`):\n\n- `../` and `..\\` path traversal characters\n- Null bytes (`\\x00`) and control characters\n- Trailing dots and spaces (Windows silently strips these, causing filename collisions)\n- All 14 Windows reserved names (AUX, LPT1-LPT9, mixed case)\n- Unicode zero-width space and combining characters\n\nThe implementation is correct (verified by adding tests that all pass), but the lack of explicit test cases meant future refactors could regress these protections without any test failure.",
  "solution": "Added a new test file `tests/test_slugify_path_traversal.py` (14 new tests) that explicitly covers the additional threat surface:\n\n- **PathTraversal class** (6 tests): Unix `../`, Windows `..\\`, absolute paths, drive letters, trailing dots, trailing spaces\n- **NullBytes class** (3 tests): null bytes, multiple null bytes, all control characters (`\\n`, `\\t`, `\\r`)\n- **WindowsReserved class** (3 tests): all 14 reserved names, lowercase variants, reserved with extension\n- **UnicodeRobustness class** (2 tests): zero-width space, NFKD decomposition\n\nAll 14 tests pass against the current implementation. The implementation is **unchanged** — only test coverage was added. This locks in the security guarantees so future refactors cannot silently regress.",
  "source": "lessons/contrib/slugify-path-traversal-deep-coverage.md",
  "test_cmd": "python3 scripts/verify_task.py lesson-slugify-path-traversal-deep-coverage"
}