Runner: Eingabepruefung gehaertet (R8)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

runner/test/server.test.js

@@ -9,10 +9,11 @@ import { validateJob } from '../src/validate.js';
 
 
 const config = { ...loadConfig({ PREVIEW_RUNNER_TOKEN: 'geheim' }) };
+const RID = '123e4567-e89b-42d3-a456-426614174000';
 const submitted = [];
 const jobs = {
-  submit: (j) => { submitted.push(j); return { runId: 'r1' }; },
-  get: (id) => (id === 'r1' ? { runId: 'r1', state: 'building' } : null),
+  submit: (j) => { submitted.push(j); return { runId: RID }; },
+  get: (id) => (id === RID ? { runId: RID, state: 'building' } : null),
   queueLength: () => 0,
 };
 const stopped = [];
@@ -73,7 +74,7 @@ test('POST /jobs/build: 400 bei ungültiger Eingabe, 200 bei gültiger', async (
     }
     const ok = await fetch(`${base}/jobs/build`, { method: 'POST', headers: auth, body: JSON.stringify(good) });
     assert.equal(ok.status, 200);
-    assert.deepEqual(await ok.json(), { runId: 'r1' });
+    assert.deepEqual(await ok.json(), { runId: RID });
     assert.equal(submitted[0].sub, 'demo');
     const nojson = await fetch(`${base}/jobs/build`, { method: 'POST', headers: auth, body: '{kaputt' });
     assert.equal(nojson.status, 400);
@@ -83,7 +84,7 @@ test('POST /jobs/build: 400 bei ungültiger Eingabe, 200 bei gültiger', async (
 test('GET /jobs/:runId, Dev-Start/Stop', async () => {
   await withServer(config, async (base) => {
     assert.equal((await fetch(`${base}/jobs/r1`, { headers: auth })).status, 200);
-    assert.equal((await fetch(`${base}/jobs/nix`, { headers: auth })).status, 404);
+    assert.equal((await fetch(`${base}/jobs/223e4567-e89b-42d3-a456-426614174000`, { headers: auth })).status, 404);
     const s = await fetch(`${base}/dev/demo/start`, { method: 'POST', headers: auth, body: JSON.stringify(good) });
     assert.equal(s.status, 200);
     assert.equal((await fetch(`${base}/dev/..x/start`, { method: 'POST', headers: auth, body: JSON.stringify(good) })).status, 400);
@@ -113,6 +114,20 @@ test('validateJob: env, index, mode', () => {
   assert.equal(validateJob(null).ok, false);
 });
 
+test('R8: Repo/Branch-Härtung, Whitelist, Sub, Lauf-ID', async () => {
+  for (const repo of ['../..', './.', '-x/y', 'a/..']) assert.equal(validateJob({ ...good, repo }).ok, false, repo);
+  for (const branch of ['-x', '--upload-pack=x', 'a..b', 'x.lock', 'x/']) assert.equal(validateJob({ ...good, branch }).ok, false, branch);
+  const v = validateJob({ ...good, devCmd: 'rm -rf /', image: 'evil' });
+  assert.equal(v.ok, true);
+  assert.deepEqual(Object.keys(v.job).sort(), ['branch', 'env', 'mode', 'repo', 'sha', 'sub']);
+  assert.equal(validateJob({ ...good, sub: 'demo\n' }).ok, false);
+  await withServer(config, async (base) => {
+    const r = await fetch(`${base}/dev/demo/start`, { method: 'POST', headers: auth, body: JSON.stringify({ ...good, sub: 'other' }) });
+    assert.equal(r.status, 400);
+    assert.equal((await fetch(`${base}/jobs/not-a-uuid`, { headers: auth })).status, 400);
+  });
+});
+
 test('readMemAvailable liest MemAvailable in Bytes', () => {
   const p = join(mkdtempSync(join(tmpdir(), 'mem-')), 'meminfo');
   writeFileSync(p, 'MemTotal:       8000000 kB\nMemFree:         100000 kB\nMemAvailable:    2048000 kB\n');