feat(security): release v0.7.0 with comprehensive security hardening (S-01 to S-11)

tests/path_traversal_test.rs

@@ -0,0 +1,62 @@
+use sanctum::sync::validate_node_name;
+
+#[test]
+fn test_validate_node_name_rejections() {
+    // 1. Leere Namen
+    assert!(validate_node_name("").is_err());
+
+    // 2. Relative Verzeichnisreferenzen
+    assert!(validate_node_name(".").is_err());
+    assert!(validate_node_name("..").is_err());
+
+    // 3. Pfadtrenner
+    assert!(validate_node_name("foo/bar").is_err());
+    assert!(validate_node_name("foo\\bar").is_err());
+    assert!(validate_node_name("../evil.exe").is_err());
+    assert!(validate_node_name("..\\evil.exe").is_err());
+    assert!(validate_node_name("/root_file").is_err());
+
+    // 4. Null-Bytes
+    assert!(validate_node_name("test\0file.txt").is_err());
+
+    // 5. Steuerzeichen (< 0x20)
+    assert!(validate_node_name("line\nbreak.txt").is_err());
+    assert!(validate_node_name("carriage\rreturn.txt").is_err());
+    assert!(validate_node_name("tab\tseparated.txt").is_err());
+    assert!(validate_node_name("control\x01char.txt").is_err());
+
+    // 6. Windows reservierte Gerätenamen
+    let reserved_names = [
+        "CON", "con", "prn", "PRN", "aux", "AUX", "nul", "NUL",
+        "COM1", "com2", "COM9", "lpt1", "LPT2", "LPT9",
+        "con.txt", "aux.dat", "NUL.tar.gz", "com1.log", "prn.pdf",
+    ];
+    for res in reserved_names {
+        assert!(
+            validate_node_name(res).is_err(),
+            "Reservierter Name '{}' muss abgewiesen werden",
+            res
+        );
+    }
+}
+
+#[test]
+fn test_validate_node_name_accepted() {
+    let valid_names = [
+        "document.pdf",
+        "my_notes_2026.txt",
+        "archive.tar.gz",
+        "spaces are allowed.docx",
+        "unicode_äöü_ß_test.rs",
+        "hyphens-and_underscores.json",
+        "file (1).jpg",
+        "normal_file",
+    ];
+    for valid in valid_names {
+        assert!(
+            validate_node_name(valid).is_ok(),
+            "Gültiger Name '{}' sollte akzeptiert werden",
+            valid
+        );
+    }
+}