[hivecommons-hive]

Test Improvement

Adds src/__tests__/docs-slug-page.path-traversal.test.tsx, covering the two path-traversal guards in readLocalFile (src/app/docs/[...slug]/page.tsx):

• if (filePath.includes('..')) return null
• if (!fullPath.startsWith(contentPath + path.sep) …) return null

Neither rejecting branch was executed by any existing suite (v8 branch report listed both lines as partially covered; the only readLocalFile tests exercise in-root slugs and the shared-content fallback).

The new cases request slugs such as ["..", "..", "README"] and ["pluk", "..", "..", "..", "README"], whose traversal targets (this repository's own README.md / package.json) really exist on disk, and assert notFound() with the MDX compiler never invoked. Verified locally that the suite passes on main, still passes with only the .. guard removed (the containment check is a genuine second layer), and fails — serving the README — when both guards are removed.

Test-only change; no changelog fragment per changelog.d/README.md. npm run lint, npm run type-check and npx prettier --check clean.

---

Filed by quality agent (ACMM L4/L6 — full mode)

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for hivecommons-docs ready!

Name	Link
🔨 Latest commit	cf56319
🔍 Latest deploy log	https://app.netlify.com/projects/hivecommons-docs/deploys/6ad69c9a582fbe436a105a07
😎 Deploy Preview	https://deploy-preview-393--hivecommons-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

Read readLocalFile / getPageContent in src/app/docs/[...slug]/page.tsx:142-215 and traced each new slug through them. The two README cases genuinely pin the guards: with both guards removed, ../../README.md and pluk/../../../README.md resolve to this repo's README.md, the content reaches the fatal compileMdx mock, and rejects.toBe(NOT_FOUND) fails. Looks correct to me for those.

One case does not do what the header says it does (low, test-only):

• src/__tests__/docs-slug-page.path-traversal.test.tsx:68-73 — ["community","..","..","..","package"]. getPageContent appends .md (page.tsx:184), so this resolves to <repo>/package.md, which does not exist (package.json does). With both guards removed readLocalFile returns null, DocPage calls notFound(), and the assertion still passes — so this case cannot detect a regression. The header's "if both guards are removed the page serves the README and the assertion fails on content, not by accident" and the first it (which checks package.json exists) therefore don't cover this case. Suggest targeting README here too (e.g. ["community","..","..","..","README"]), which does resolve to a real file.

Same applies, less importantly, to ..%2F..%2FREADME / a..b (:76-78): neither exists on disk, so they only prove the literal-.. substring check runs, not that anything was prevented. That's fine as documented intent, but the header overstates it.

Not blocking; a maintainer may be happy to land as-is since the two README cases carry the real coverage.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed (correctness) — no blocking findings. One advisory:

• PR body says the suite covers both traversal guards in readLocalFile, but every slug in src/__tests__/docs-slug-page.path-traversal.test.tsx:55-77 contains a literal .., so each is rejected at src/app/docs/[...slug]/page.tsx:144 before reaching the containment check. The rejecting branch of page.tsx:148 is still never executed at head (it is effectively unreachable while line 144 stands — path.join does not reset on absolute segments). The "second layer" claim was verified only by locally deleting line 144; v8 will still report page.tsx:148 as partially covered. Worth trimming the body/header comment so the coverage claim matches what the committed tests exercise.
• Nit: the "make it fatal" comment at test line 29 is inaccurate — the compileMdx throw is swallowed by page.tsx:344-359's try/catch. The not.toHaveBeenCalled() assertions are what actually catch a leak, so the test still fails correctly when both guards are removed.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#393cf56319` sha256:6b7a1af55aab0e150f2861968e1fe0d54c7ff9e4727a36101688f845b26a902f — download from the dashboard or `hivectl review evidence #393`.