release: v0.7.1 — Security-Patch (R-01 bis R-06)

- R-01: Bereinigung verbliebener Restbehauptungen in Doku und Code (LEGAL.md, README.md, QUICKSTART.md, main.rs, crypto/storage/recovery/verify.rs)
- R-02: Lückenloser Carrier-Schutz in SanctumFs::copy (Quelle & Ziel) und sync (Pull-Skip & Push-Schutz)
- R-03: Shared Dateinamen-Validierung (validate_node_name) in pathutil.rs, durchgesetzt in storage.rs und vfs.rs
- R-04: Fail-closed Release-Packaging & obligatorische Minisign-Signatur in CI (.gitea/workflows/release.yaml) und Scripts
- R-05: Session-Token Beseitigung im argv: In-Process Win32 WNetAddConnection2W/WNetCancelConnection2W, kein gio argv-Token, Multi-Auth HTTP Middleware (Basic Auth, X-Sanctum-Token, Path-Fallback) mit 401 WWW-Authenticate
- R-06: Sofortiges Löschen von SANCTUM_RECOVERY_KEY aus der Prozessumgebung

tests/path_traversal_test.rs

@@ -1,4 +1,4 @@
-use sanctum::sync::validate_node_name;
+use sanctum::sync::validate_node_name;
 
 #[test]
 fn test_validate_node_name_rejections() {
@@ -60,3 +60,40 @@ fn test_validate_node_name_accepted() {
         );
     }
 }
+
+#[test]
+fn test_storage_create_and_rename_reject_invalid_names() {
+    let mut path = std::env::temp_dir();
+    path.push(format!("sanctum_test_pathutil_{}.sanctum", std::process::id()));
+    if path.exists() {
+        let _ = std::fs::remove_file(&path);
+    }
+
+    let salt = sanctum::crypto::generate_salt();
+    let kdf_params = sanctum::crypto::KdfParams {
+        memory_cost: sanctum::crypto::MIN_MEMORY_COST_KIB,
+        time_cost: sanctum::crypto::MIN_TIME_COST,
+        parallelism: 1,
+    };
+    let kek = sanctum::crypto::derive_kek("Pass1234!", &salt, &kdf_params).unwrap();
+    let dek = sanctum::crypto::generate_dek();
+    let (wrapped, nonce, tag) = sanctum::crypto::wrap_dek(&kek, &dek).unwrap();
+
+    let db = sanctum::storage::Database::open(&path).unwrap();
+    db.init_schema(&salt, &kdf_params, &wrapped, &nonce, &tag).unwrap();
+
+    // create_node_in_vault mit ungültigem Namen muss scheitern
+    assert!(db.create_node_in_vault(0, 1, "..", false, &dek).is_err());
+    assert!(db.create_node_in_vault(0, 1, "CON", false, &dek).is_err());
+    assert!(db.create_node_in_vault(0, 1, "sub/dir", false, &dek).is_err());
+
+    // Gültige Datei erstellen
+    let valid_node = db.create_node_in_vault(0, 1, "valid.txt", false, &dek).unwrap();
+
+    // rename_node_in_vault mit ungültigem Namen muss scheitern
+    assert!(db.rename_node_in_vault(valid_node.id, 1, "..", 0, &dek).is_err());
+    assert!(db.rename_node_in_vault(valid_node.id, 1, "AUX", 0, &dek).is_err());
+    assert!(db.rename_node_in_vault(valid_node.id, 1, "bad\\name", 0, &dek).is_err());
+
+    let _ = std::fs::remove_file(&path);
+}