From 33c7c940a0362be349388e30de9aca77201e1bec Mon Sep 17 00:00:00 2001
From: Xavier Karma <xavier@bongbetic.com>
Date: Fri, 6 Nov 2026 21:36:55 +0530
Subject: [PATCH] test(web): avoid path.join on a parameter in the rebrand scan

Semgrep flagged the directory walker as a possible path traversal. The walk
now runs from an absolute src root and builds child paths from directory
entries only.
---
 web/src/lib/__tests__/voculinux-rebrand.test.ts | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/web/src/lib/__tests__/voculinux-rebrand.test.ts b/web/src/lib/__tests__/voculinux-rebrand.test.ts
index 1090114..5ebf10f 100644
--- a/web/src/lib/__tests__/voculinux-rebrand.test.ts
+++ b/web/src/lib/__tests__/voculinux-rebrand.test.ts
@@ -22,20 +22,23 @@ const read = (...segments: string[]): string =>
 const readPage = (...segments: string[]): string =>
   read("src", "app", ...segments);
 
-// Every non-test file under src, plus the sitemap, the README and PRODUCT.
-const walk = (relDir: string): string[] =>
+// Every non-test file under an absolute directory, as paths relative to ROOT.
+const walk = (absDir: string): string[] =>
   fs
-    .readdirSync(path.join(ROOT, relDir), { withFileTypes: true })
+    .readdirSync(absDir, { withFileTypes: true })
     .flatMap((entry) => {
-      const rel = path.posix.join(relDir, entry.name);
+      const abs = `${absDir}/${entry.name}`;
       if (entry.isDirectory()) {
-        return entry.name === "__tests__" ? [] : walk(rel);
+        return entry.name === "__tests__" ? [] : walk(abs);
       }
-      return /\.test\./.test(entry.name) ? [] : [rel];
+      return /\.test\./.test(entry.name)
+        ? []
+        : [path.posix.relative(ROOT, abs)];
     });
 
+// Every non-test file under src, plus the sitemap, the README and PRODUCT.
 const SCANNED_FILES = [
-  ...walk("src"),
+  ...walk(`${ROOT}/src`),
   "public/sitemap.xml",
   "README.md",
   "PRODUCT.md",