From 81484ad770e859e49da2a4bb5cd0ab01edf89de1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 21 Mar 2026 12:23:02 +0000
Subject: [PATCH] test: add -- separator assertions to rclone and ocrmypdf
 tests

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/c7ac9d75-d2de-499e-b7e8-8b0f694547f5
---
 tests/test_convert_to_pdfa.py | 5 +++++
 tests/test_upload_handlers.py | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/tests/test_convert_to_pdfa.py b/tests/test_convert_to_pdfa.py
index 12ee6243..734ca988 100644
--- a/tests/test_convert_to_pdfa.py
+++ b/tests/test_convert_to_pdfa.py
@@ -38,6 +38,11 @@ class TestConvertPdfToPdfa:
         assert "pdfa-2" in cmd
         assert "--quiet" in cmd
         assert "--invalidate-digital-signatures" in cmd
+        # SECURITY: Verify `--` end-of-options separator is present and precedes
+        # the file paths to prevent option/argument injection.
+        assert "--" in cmd
+        assert cmd.index("--") < cmd.index("/input.pdf")
+        assert cmd.index("--") < cmd.index("/output.pdf")
         assert "/input.pdf" in cmd
         assert "/output.pdf" in cmd
 
diff --git a/tests/test_upload_handlers.py b/tests/test_upload_handlers.py
index e18e26d5..192cdf98 100644
--- a/tests/test_upload_handlers.py
+++ b/tests/test_upload_handlers.py
@@ -769,6 +769,11 @@ class TestUploadRclone:
         cmd = mock_run.call_args[0][0]
         assert cmd[0] == "rclone"
         assert cmd[1] == "copyto"
+        # SECURITY: Verify `--` end-of-options separator is present and precedes
+        # the file path and destination to prevent option/argument injection.
+        assert "--" in cmd
+        fp_index = next(i for i, v in enumerate(cmd) if v == fp)
+        assert cmd.index("--") < fp_index
 
     def test_raises_on_rclone_nonzero_exit(self, tmp_path):
         fp = str(tmp_path / "doc.pdf")