test: add -- separator assertions to rclone and ocrmypdf tests

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/c7ac9d75-d2de-499e-b7e8-8b0f694547f5
2026-03-21 12:23:02 +00:00
parent 902f109551
commit 81484ad770
2 changed files with 10 additions and 0 deletions
@@ -769,6 +769,11 @@ class TestUploadRclone:
        cmd = mock_run.call_args[0][0]
        assert cmd[0] == "rclone"
        assert cmd[1] == "copyto"
+        # SECURITY: Verify `--` end-of-options separator is present and precedes
+        # the file path and destination to prevent option/argument injection.
+        assert "--" in cmd
+        fp_index = next(i for i, v in enumerate(cmd) if v == fp)
+        assert cmd.index("--") < fp_index

    def test_raises_on_rclone_nonzero_exit(self, tmp_path):
        fp = str(tmp_path / "doc.pdf")