Peer API path guard test never covers the backslash separators it rejects
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 95/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- express, javascript
Research direction
Read hasAmbiguousSegment in server/lib/apiAccessPolicy.js and the existing separator cases in server/lib/apiAccessPolicy.test.js. Add the encoded and literal backslash paths to the existing test table, then run apiAccessPolicy.test.js and authGate.test.js. Done means removing the %5c and backslash checks from the guard makes the test fail, with no production code changed.
Written by the indexing model from the issue text.
Description
Slice audited: external auth boundary tests (test-quality audit, 2026-10-18).
Problem
hasAmbiguousSegment in server/lib/apiAccessPolicy.js:80 refuses //, dot segments, %2e, %2f, %5c and a literal backslash before a peer credential's prefix rule is applied. server/lib/apiAccessPolicy.test.js:76 ("refuses dot, empty, and encoded separator segments") covers every alternative except %5c and \.
Mutation probe (scratch worktree): removed |%5c|\\ from the regex and ran apiAccessPolicy.test.js and authGate.test.js.
Test Files 2 passed (2) Tests 89 passed (89)
Impact
Low. The source comment frames the branch as defense in depth against "a later layer that might normalize differently", and express.static normalizes both separators today. The cost is a guard branch that can be deleted with the suite green; a future static-serving change would then have no test naming the case.
Fix (decided)
Add /data/images/a%5cb.png and /data/images/a\\b.png to the existing for table in apiAccessPolicy.test.js:76. No production code change.
Scope: small
Acceptance criteria
- Removing
|%5c|\\fromhasAmbiguousSegmentfails the test. - No production code change.
- Dominant language
- JavaScript
- Stars
- 38
- Forks
- 32
- Avg merge
- 40m
- Merged PRs (30d)
- 996
Getting set up
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from atomantic/PortOS
-
effort:low model:light plan planner:fable-5-1 test-quality tests
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
Series autopilot "skips when disabled" test passes through the crash catch-all, not the skip guardOpeneffort:low model:light plan planner:fable-5-1 test-quality tests
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
Maintainers usually reply within 1 day
-
effort:low model:light plan planner:fable-5-1 test-quality tests
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
Maintainers usually reply within 1 day
-
effort:low model:light plan planner:fable-5-1 test-quality tests
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
Always-public API path check has no refusal test, so a prefix-match regression opens gated routesOpeneffort:low model:light plan planner:fable-5-1 test-quality tests
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
Maintainers usually reply within 1 day
All issues in atomantic/PortOS
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 65/100
521xueweihan/HelloGitHub#4025 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
iib0011/omni-tools#479 ·
Maintainers usually reply within 1 day
-
triage
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
pixelfed/pixelfed-rn#508 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
yetone/magpie#2844 · 1 comment ·
Maintainers usually reply within 1 day