From 5c5bf50e49a22360850453fc7cec21cff318c9e4 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Sun, 8 Feb 2026 07:41:00 -0600 Subject: [PATCH] Update test docstring to reflect validation instead of sanitization --- tests/dashboard/test_web_server.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/dashboard/test_web_server.py b/tests/dashboard/test_web_server.py index d21873cf61e..2924e09f771 100644 --- a/tests/dashboard/test_web_server.py +++ b/tests/dashboard/test_web_server.py @@ -552,8 +552,8 @@ async def test_download_binary_handler_path_traversal_protection( ) -> None: """Test that DownloadBinaryRequestHandler prevents path traversal attacks. - Verifies that attempts to use '..' in file paths are sanitized to prevent - accessing files outside the build directory. Tests multiple attack vectors. + Verifies that attempts to escape the build directory via '..' are rejected + using resolve()/relative_to() validation. Tests multiple attack vectors. Real traversals that escape the base directory get 403. Paths like '....' that resolve inside the base directory but don't exist get 404. """