Merge pull request #777 from christianlouis/copilot/sub-pr-774-another-one

test: lock in `--` end-of-options separator for rclone and ocrmypdf subprocess calls

tests/test_convert_to_pdfa.py

@@ -38,6 +38,11 @@ class TestConvertPdfToPdfa:
         assert "pdfa-2" in cmd
         assert "--quiet" in cmd
         assert "--invalidate-digital-signatures" in cmd
+        # SECURITY: Verify `--` end-of-options separator is present and precedes
+        # the file paths to prevent option/argument injection.
+        assert "--" in cmd
+        assert cmd.index("--") < cmd.index("/input.pdf")
+        assert cmd.index("--") < cmd.index("/output.pdf")
         assert "/input.pdf" in cmd
         assert "/output.pdf" in cmd
 

tests/test_upload_handlers.py

@@ -769,6 +769,11 @@ class TestUploadRclone:
         cmd = mock_run.call_args[0][0]
         assert cmd[0] == "rclone"
         assert cmd[1] == "copyto"
+        # SECURITY: Verify `--` end-of-options separator is present and precedes
+        # the file path and destination to prevent option/argument injection.
+        assert "--" in cmd
+        fp_index = next(i for i, v in enumerate(cmd) if v == fp)
+        assert cmd.index("--") < fp_index
 
     def test_raises_on_rclone_nonzero_exit(self, tmp_path):
         fp = str(tmp_path / "doc.pdf")