test: add -- separator assertions to rclone and ocrmypdf tests

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/c7ac9d75-d2de-499e-b7e8-8b0f694547f5
2026-03-21 12:23:02 +00:00
parent 902f109551
commit 81484ad770
2 changed files with 10 additions and 0 deletions
@@ -38,6 +38,11 @@ class TestConvertPdfToPdfa:
        assert "pdfa-2" in cmd
        assert "--quiet" in cmd
        assert "--invalidate-digital-signatures" in cmd
+        # SECURITY: Verify `--` end-of-options separator is present and precedes
+        # the file paths to prevent option/argument injection.
+        assert "--" in cmd
+        assert cmd.index("--") < cmd.index("/input.pdf")
+        assert cmd.index("--") < cmd.index("/output.pdf")
        assert "/input.pdf" in cmd
        assert "/output.pdf" in cmd