From 6fd78e0515e8a229d5e1d1f1034ed60c728ecff6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Cezar=20Mois=C3=A9s?= <sac@securityops.co>
Date: Mon, 31 Aug 2026 21:25:10 -0300
Subject: [PATCH] test: make Windows Unicode gate byte-exact

---
 .github/workflows/cross-platform.yml | 21 +++++++++++++++++----
 tests/test_path_traversal.sh         | 10 +++++++---
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/cross-platform.yml b/.github/workflows/cross-platform.yml
index 0c10766..fc21650 100644
--- a/.github/workflows/cross-platform.yml
+++ b/.github/workflows/cross-platform.yml
@@ -86,20 +86,33 @@ jobs:
           trap 'chmod -R u+rwX "$test_root" 2>/dev/null || true; rm -rf -- "$test_root"' EXIT
           output_dir="$test_root/saída-安全"
           archive="$test_root/cópia-安全.zupt"
+          emoji_name=$'emoji-\xF0\x9F\x98\x80.bin'
           mkdir -p "$test_root/input/subdir" "$output_dir"
           printf 'Windows release smoke test\n' > "$test_root/input/café.txt"
           printf 'UTF-8: café-安全\n' > "$test_root/input/subdir/ação-安全.txt"
-          printf 'emoji filename\n' > "$test_root/input/subdir/emoji-😀.bin"
+          printf 'emoji filename\n' > "$test_root/input/subdir/$emoji_name"
           : > "$test_root/input/empty"
           dd if=/dev/urandom of="$test_root/input/subdir/random.bin" bs=4096 count=4 2>/dev/null
           (cd "$test_root" && "$exe" compress "$archive" input)
           "$exe" test "$archive"
           "$exe" list "$archive" > "$test_root/list.txt" 2>&1
-          grep -F 'café.txt' "$test_root/list.txt"
-          grep -F 'ação-安全.txt' "$test_root/list.txt"
-          grep -F 'emoji-😀.bin' "$test_root/list.txt"
           "$exe" extract -o "$output_dir" "$archive"
           diff -r "$test_root/input" "$output_dir/input"
+          python3 - "$test_root/list.txt" <<'PY'
+          import pathlib
+          import sys
+
+          listing = pathlib.Path(sys.argv[1]).read_bytes()
+          expected = {
+              "Latin-1": bytes.fromhex("636166c3a92e747874"),
+              "BMP": bytes.fromhex("61c3a7c3a36f2de5ae89e585a82e747874"),
+              "non-BMP": bytes.fromhex("656d6f6a692df09f98802e62696e"),
+          }
+          missing = [label for label, name in expected.items() if name not in listing]
+          if missing:
+              raise SystemExit("list output is missing exact UTF-8 names: " +
+                               ", ".join(missing))
+          PY
           objdump -p "$exe" > "$test_root/imports.txt"
           if grep -Eqi '(vendor[/\\]|libvuptsdk|libpqvaptvupt|libgcc_s|libstdc\+\+|libwinpthread|msys-2[.]0|cygwin1)[^[:space:]]*[.]dll' \
               "$test_root/imports.txt"; then
diff --git a/tests/test_path_traversal.sh b/tests/test_path_traversal.sh
index feadad7..7982673 100755
--- a/tests/test_path_traversal.sh
+++ b/tests/test_path_traversal.sh
@@ -248,13 +248,17 @@ else
     fail 'backslash separators are normalized within the extraction root'
 fi
 
-legitimate_entry_hex=73616665206469722f61c3a7c3a36f2e747874
+legitimate_entry_hex=73616665206469722f61c3a7c3a36f2df09f98802e747874
 MSYS2_ARG_CONV_EXCL='--entry-hex=' \
     "$FIXTURE" "$TEST_ROOT/legitimate.zupt" \
     "--entry-hex=$legitimate_entry_hex"
 mkdir "$TEST_ROOT/legitimate-out"
 if file_contains_hex_bytes "$TEST_ROOT/legitimate.zupt" \
         "$legitimate_entry_hex" &&
+   "$ZUPT_BIN" list "$TEST_ROOT/legitimate.zupt" \
+        > "$TEST_ROOT/legitimate-list.log" 2>&1 &&
+   file_contains_hex_bytes "$TEST_ROOT/legitimate-list.log" \
+        "$legitimate_entry_hex" &&
    "$ZUPT_BIN" extract -o "$TEST_ROOT/legitimate-out" \
         "$TEST_ROOT/legitimate.zupt" > "$TEST_ROOT/legitimate.log" 2>&1 &&
    python3 - "$TEST_ROOT/legitimate-out" "$legitimate_entry_hex" <<'PY'
@@ -268,9 +272,9 @@ extracted = pathlib.Path(sys.argv[1]).joinpath(*relative_path.split("/"))
 raise SystemExit(0 if extracted.read_bytes() == b"fixture content\n" else 1)
 PY
 then
-    pass 'safe nested UTF-8 path extracts normally'
+    pass 'safe nested BMP and non-BMP UTF-8 path lists and extracts normally'
 else
-    fail 'safe nested UTF-8 path extracts normally'
+    fail 'safe nested BMP and non-BMP UTF-8 path lists and extracts normally'
 fi
 
 mkdir -p "$TEST_ROOT/relative-root/work"