From 0177c433ec566af0d45a8c5ca37b5bb4523dbd0d Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Thu, 12 Feb 2026 07:05:30 +0000 Subject: [PATCH] test: use module-scope imports and tempDir from harness Replace dynamic `await import("fs")` / `await import("os")` with `tempDir` from harness for temporary directory creation. Co-Authored-By: Claude --- .../issue/header-injection-content-disposition.test.ts | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/test/regression/issue/header-injection-content-disposition.test.ts b/test/regression/issue/header-injection-content-disposition.test.ts index e1817216c6..8a5797f05d 100644 --- a/test/regression/issue/header-injection-content-disposition.test.ts +++ b/test/regression/issue/header-injection-content-disposition.test.ts @@ -1,4 +1,5 @@ import { expect, test } from "bun:test"; +import { tempDir } from "harness"; test("Content-Disposition header injection via CRLF in File name", async () => { await using server = Bun.serve({ @@ -57,12 +58,10 @@ test("Content-Disposition header injection via quotes in File name", async () => }); test("Content-Disposition header injection via Bun.file with crafted path", async () => { - // Create a file with CRLF in the name on the filesystem (Linux allows this) - const fs = await import("fs"); - const os = await import("os"); - const tmpDir = fs.mkdtempSync(os.tmpdir() + "/bun-test-crlf-"); + // Create a temp dir, then add a file with CRLF in its name (Linux allows this) + using dir = tempDir("crlf-filename", {}); const maliciousFilename = "evil.bin\r\nX-Injected: true"; - const filePath = tmpDir + "/" + maliciousFilename; + const filePath = `${dir}/${maliciousFilename}`; let fileCreated = false; try {