From 4a6020c574a7dc3af412eef996c5a5ba65200cc5 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 13 Mar 2026 19:24:22 +0000
Subject: [PATCH] test: tighten numeric parsing and path safety coverage

---
 src/infra/parse-finite-number.test.ts | 14 ++++++++++----
 src/infra/path-safety.test.ts         |  4 ++++
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/src/infra/parse-finite-number.test.ts b/src/infra/parse-finite-number.test.ts
index d3c838cf61a..46329f3001b 100644
--- a/src/infra/parse-finite-number.test.ts
+++ b/src/infra/parse-finite-number.test.ts
@@ -11,11 +11,13 @@ describe("parseFiniteNumber", () => {
     { value: 42, expected: 42 },
     { value: "3.14", expected: 3.14 },
     { value: " 3.14ms", expected: 3.14 },
+    { value: "+7", expected: 7 },
+    { value: "1e3", expected: 1000 },
   ])("parses %j", ({ value, expected }) => {
     expect(parseFiniteNumber(value)).toBe(expected);
   });
 
-  it.each([Number.NaN, Number.POSITIVE_INFINITY, "not-a-number", " ", null])(
+  it.each([Number.NaN, Number.POSITIVE_INFINITY, "not-a-number", " ", "", null])(
     "returns undefined for %j",
     (value) => {
       expect(parseFiniteNumber(value)).toBeUndefined();
@@ -28,13 +30,17 @@ describe("parseStrictInteger", () => {
     { value: "42", expected: 42 },
     { value: " -7 ", expected: -7 },
     { value: 12, expected: 12 },
+    { value: "+9", expected: 9 },
   ])("parses %j", ({ value, expected }) => {
     expect(parseStrictInteger(value)).toBe(expected);
   });
 
-  it.each(["42ms", "0abc", "1.5", " ", Number.MAX_SAFE_INTEGER + 1])("rejects %j", (value) => {
-    expect(parseStrictInteger(value)).toBeUndefined();
-  });
+  it.each(["42ms", "0abc", "1.5", "1e3", " ", Number.MAX_SAFE_INTEGER + 1])(
+    "rejects %j",
+    (value) => {
+      expect(parseStrictInteger(value)).toBeUndefined();
+    },
+  );
 });
 
 describe("parseStrictPositiveInteger", () => {
diff --git a/src/infra/path-safety.test.ts b/src/infra/path-safety.test.ts
index 9c85fbac63e..4e89c1c35fb 100644
--- a/src/infra/path-safety.test.ts
+++ b/src/infra/path-safety.test.ts
@@ -6,6 +6,7 @@ describe("path-safety", () => {
   it.each([
     { rootDir: "/tmp/demo", expected: `${path.resolve("/tmp/demo")}${path.sep}` },
     { rootDir: `/tmp/demo${path.sep}`, expected: `${path.resolve("/tmp/demo")}${path.sep}` },
+    { rootDir: "/tmp/demo/..", expected: `${path.resolve("/tmp")}${path.sep}` },
   ])("resolves safe base dir for %j", ({ rootDir, expected }) => {
     expect(resolveSafeBaseDir(rootDir)).toBe(expected);
   });
@@ -13,8 +14,11 @@ describe("path-safety", () => {
   it.each([
     { rootDir: "/tmp/demo", targetPath: "/tmp/demo", expected: true },
     { rootDir: "/tmp/demo", targetPath: "/tmp/demo/sub/file.txt", expected: true },
+    { rootDir: "/tmp/demo", targetPath: "/tmp/demo/./nested/../file.txt", expected: true },
+    { rootDir: "/tmp/demo", targetPath: "/tmp/demo-two/../demo/file.txt", expected: true },
     { rootDir: "/tmp/demo", targetPath: "/tmp/demo/../escape.txt", expected: false },
     { rootDir: "/tmp/demo", targetPath: "/tmp/demo-sibling/file.txt", expected: false },
+    { rootDir: "/tmp/demo", targetPath: "/tmp/demo/../../escape.txt", expected: false },
     { rootDir: "/tmp/demo", targetPath: "sub/file.txt", expected: false },
   ])("checks containment for %j", ({ rootDir, targetPath, expected }) => {
     expect(isWithinDir(rootDir, targetPath)).toBe(expected);