Initial

server/test/builder.test.mjs

@@ -4,6 +4,7 @@ import assert from 'node:assert/strict';
 import { load } from './setup.mjs';
 
 const { buildPackagerInvocation, expectedOutputFile, resolveToolPath, builderAvailability } = await load('../services/intuneWinBuilder.js');
+const { isPathInside, normalizePackagePath, sanitizeFileName } = await load('../utils/pathUtils.js');
 
 test('bundled invocation uses IntuneWinAppUtil flags', () => {
   const inv = buildPackagerInvocation({ toolPath: 'C:/tools/IntuneWinAppUtil.exe', sourceFolder: 'C:/src', setupFile: 'setup.exe', outputDir: 'C:/out' });
@@ -24,6 +25,18 @@ test('external command template substitutes placeholders', () => {
 test('expectedOutputFile names after the setup base name', () => {
   assert.ok(expectedOutputFile('/out', 'ContosoVpnSetup.exe').endsWith('ContosoVpnSetup.intunewin'));
   assert.ok(expectedOutputFile('/out', 'app.msi').endsWith('app.intunewin'));
+  assert.ok(expectedOutputFile('/out', 'Files\\Vendor Setup.exe').endsWith('Vendor Setup.intunewin'));
+});
+
+test('path utilities normalize Windows-style upload and package paths', () => {
+  assert.equal(sanitizeFileName('C:\\temp\\Contoso VPN?.msi'), 'Contoso VPN-.msi');
+  assert.equal(normalizePackagePath('Files\\Installers\\..\\setup.exe'), 'Files/Installers/setup.exe');
+  assert.equal(normalizePackagePath('../SupportFiles/config.json'), 'SupportFiles/config.json');
+});
+
+test('path containment rejects sibling directories with the same prefix', () => {
+  assert.equal(isPathInside('/tmp/FileLocker', '/tmp/FileLocker/assets/a.bin'), true);
+  assert.equal(isPathInside('/tmp/FileLocker', '/tmp/FileLocker2/assets/a.bin'), false);
 });
 
 test('resolveToolPath defaults into the tools directory', () => {