test(backend): Phase 2 - Add Missing Security & Error Handling Tests

[gander]

Summary

Phase 2 of Test Suite Quality Improvements: Add Missing Security & Error Handling Tests to improve backend test coverage and catch security vulnerabilities.

Changes

1. API Security Tests (api-security.test.ts)

• ✅ Added 2 XSS prevention tests (project name, project description fields)
• ✅ Added 2 Command injection prevention tests (semicolon and pipe patterns)
• ✅ Removed 2 invalid tests (backticks, dollar signs - not security risks in browser context where URLs are passed to Playwright, not shell)

2. Path Traversal Edge Cases (path-traversal-advanced.test.ts)

• ✅ Added test for control characters in pageId (null bytes)
• ✅ Added test for oversized path segments (5000 chars - accepts 400 or 404)

3. Error Handling Tests (error-handling.test.ts) - NEW FILE

• ✅ Added test for large but valid payloads (100KB description)
• ✅ Added test for extremely large payloads (10MB - expects 400 or 413)
• ✅ Added test for concurrent scan creations (verifies different projectIds)

Test Results

All tests passing with both Node.js versions:

Node 22.21.1

• api-security.test.ts: 27 tests passing
• path-traversal-advanced.test.ts: 37 tests passing
• error-handling.test.ts: 3 tests passing

Node 24.12.0

• api-security.test.ts: 27 tests passing
• path-traversal-advanced.test.ts: 37 tests passing
• error-handling.test.ts: 3 tests passing

Abandoned Work

❌ Rate limiting tests: Investigation revealed that @ts-rest/fastify doesn't support standard Fastify route-level rate limiting configuration. Rate limiting is configured via metadata but headers are not present in responses. Would require architectural changes to implement properly.

Verification

# Run all new/modified tests
npm test -- api-security.test.ts
npm test -- path-traversal-advanced.test.ts
npm test -- error-handling.test.ts

# Verify formatting
npx -y @biomejs/biome@2.3.11 ci

Related

• Plan: Test Suite Quality Improvements (Phase 2)
• Branch: test/missing-tests-phase2
• Next: Phase 2.3 - Frontend Accessibility Tests

🤖 Generated with Claude Code