From 52ba71ad609605df18225e57f722cdf90c97de88 Mon Sep 17 00:00:00 2001 From: John Kennedy Date: Sun, 19 Jul 2026 23:31:19 +0000 Subject: [PATCH] test: cover env path containment --- libs/cli/tests/unit_tests/test_deploy_helpers.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libs/cli/tests/unit_tests/test_deploy_helpers.py b/libs/cli/tests/unit_tests/test_deploy_helpers.py index cdeb0d3f5..9e43fc677 100644 --- a/libs/cli/tests/unit_tests/test_deploy_helpers.py +++ b/libs/cli/tests/unit_tests/test_deploy_helpers.py @@ -227,6 +227,14 @@ class TestResolveEnvPath: resolved = _resolve_env_path({"env": "custom.env"}, config_path) assert resolved == env_file.resolve() + @pytest.mark.parametrize("env_field", ["../outside.env", "/etc/passwd"]) + def test_env_path_outside_project_raises(self, tmp_path, env_field): + config_path = tmp_path / "langgraph.json" + config_path.touch() + + with pytest.raises(click.UsageError, match="resolves outside the project"): + _resolve_env_path({"env": env_field}, config_path) + def test_missing_env_file_returns_none(self, tmp_path): config_path = tmp_path / "langgraph.json" config_path.touch()