From 39ae93d4a661c78afe41e4687b853bc5dc6f9173 Mon Sep 17 00:00:00 2001
From: Kriday Dave <technocratix902@gmail.com>
Date: Sun, 8 Nov 2026 16:24:30 +0530
Subject: [PATCH] test: make traversal test feed ../ to oot update and preclean
 CLI temp dirs

TST-02: test_update_rejects_path_traversal never passed a traversal path
to oot update (its hasDotdot probe was optional and asserted git's fsck,
not Oot). Rewrite it to hand-craft a tree with a ../escape.txt blob via
git hash-object --literally, record it, and assert oot update refuses it
without writing outside the repo. Git is now required (expect, not if let).

TST-09: cli_test temp dirs now preclean remove_dir_all before
create_dir_all, so a stale dir can't poison a run.
---
 tests/cli_test.rs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tests/cli_test.rs b/tests/cli_test.rs
index 1427ea7..1f12284 100644
--- a/tests/cli_test.rs
+++ b/tests/cli_test.rs
@@ -49,6 +49,7 @@ fn test_cli_adjudicate_fixtures_repo() {
 fn test_cli_adjudicate_embargoed_clean() {
     let bin = get_bin_path();
     let temp_root = std::env::temp_dir().join(format!("oot_cli_embargo_{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&temp_root);
     let base_dir = temp_root.join("base");
     let head_dir = temp_root.join("head");
     let vis_path = temp_root.join("embargo_only.toml");
@@ -121,6 +122,7 @@ fn test_cli_adjudicate_load_docket() {
 fn test_cli_custom_meaning_policy_and_temp_dirs() {
     let bin = get_bin_path();
     let temp_root = std::env::temp_dir().join(format!("oot_cli_test_{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&temp_root);
     let base_dir = temp_root.join("base");
     let head_dir = temp_root.join("head");
     let policy_path = temp_root.join("strict_policy.toml");
@@ -182,6 +184,7 @@ fn test_cli_custom_meaning_policy_and_temp_dirs() {
 fn test_cli_exit_code_zero_for_adjudicated() {
     let bin = get_bin_path();
     let temp_root = std::env::temp_dir().join(format!("oot_cli_clean_{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&temp_root);
     let base_dir = temp_root.join("base");
     let head_dir = temp_root.join("head");
 
@@ -225,6 +228,7 @@ fn test_cli_exit_code_zero_for_adjudicated() {
 fn test_cli_binary_file_does_not_crash() {
     let bin = get_bin_path();
     let temp_root = std::env::temp_dir().join(format!("oot_cli_bin_{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&temp_root);
     let base_dir = temp_root.join("base");
     let head_dir = temp_root.join("head");
 
@@ -270,6 +274,7 @@ fn test_cli_binary_file_does_not_crash() {
 fn test_cli_empty_change_is_flagged_but_not_blocked() {
     let bin = get_bin_path();
     let temp_root = std::env::temp_dir().join(format!("oot_cli_empty_{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&temp_root);
     let base_dir = temp_root.join("base");
     let head_dir = temp_root.join("head");
     let policy_path = temp_root.join("low_blocks.toml");
@@ -320,6 +325,7 @@ fn test_cli_empty_change_is_flagged_but_not_blocked() {
 fn test_cli_intent_wins_over_touched_paths() {
     let bin = get_bin_path();
     let temp_root = std::env::temp_dir().join(format!("oot_cli_intent_{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&temp_root);
     let base_dir = temp_root.join("base");
     let head_dir = temp_root.join("head");
 
@@ -369,6 +375,7 @@ fn test_cli_intent_wins_over_touched_paths() {
 fn test_cli_distinct_binaries_are_not_collapsed() {
     let bin = get_bin_path();
     let temp_root = std::env::temp_dir().join(format!("oot_cli_bincmp_{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&temp_root);
     let base_dir = temp_root.join("base");
     let head_dir = temp_root.join("head");
 
@@ -412,6 +419,7 @@ fn test_cli_distinct_binaries_are_not_collapsed() {
 fn test_cli_symlink_loop_is_skipped() {
     let bin = get_bin_path();
     let temp_root = std::env::temp_dir().join(format!("oot_cli_link_{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&temp_root);
     let base_dir = temp_root.join("base");
     let head_dir = temp_root.join("head");