RouterOS/RouterOSAssistantTests/NetworkToolsServiceTests.swift

import XCTest
@testable import RouterOSAssistant

/// A LAN device's IP/hostname ultimately comes from its own DHCP request — attacker-controllable
/// by a rogue device on the network — and gets interpolated into a RouterOS console command
/// string for ping/traceroute/resolve. RouterOS' console treats ";" as a command separator, so an
/// unsanitized value could inject a second command; these tests lock in the allow-list that
/// prevents that.
final class NetworkToolsServiceTests: XCTestCase {
    func testAcceptsValidIPv4Address() throws {
        XCTAssertEqual(try NetworkToolsService.sanitized("192.168.88.10"), "192.168.88.10")
    }

    func testAcceptsValidIPv6Address() throws {
        XCTAssertEqual(try NetworkToolsService.sanitized("fe80::1"), "fe80::1")
    }

    func testAcceptsValidHostname() throws {
        XCTAssertEqual(try NetworkToolsService.sanitized("my-laptop.local"), "my-laptop.local")
    }

    func testRejectsCommandInjectionViaSemicolon() {
        XCTAssertThrowsError(try NetworkToolsService.sanitized("8.8.8.8; /system reset-configuration"))
    }

    func testRejectsWhitespaceAndQuotes() {
        XCTAssertThrowsError(try NetworkToolsService.sanitized("8.8.8.8 count=1000000"))
        XCTAssertThrowsError(try NetworkToolsService.sanitized("\"; malicious"))
    }

    func testRejectsEmptyValue() {
        XCTAssertThrowsError(try NetworkToolsService.sanitized(""))
    }
}