2 files changed, 41 insertions, 0 deletions

diff --git a/test/models/node_test.rb b/test/models/node_test.rb
index c8e49e5..4401651 100644
--- a/test/models/node_test.rb
+++ b/test/models/node_test.rb
@@ -761,4 +761,13 @@ class NodeTest < ActiveSupport::TestCase
     assert_equal "Second",    action.metadata.dig("title", "from")
     assert_equal "First",     action.metadata.dig("title", "to")
   end
+
+  test "default_template_name rejects values not present in the template directory" do
+    node = Node.root.children.build(:slug => "template_guard_test",
+                                     :default_template_name => "../../layouts/admin")
+    assert_not node.valid?
+
+    node.default_template_name = "standard_template"
+    assert node.valid?
+  end
 end
diff --git a/test/models/page_test.rb b/test/models/page_test.rb
index edb7c37..58794d5 100644
--- a/test/models/page_test.rb
+++ b/test/models/page_test.rb
@@ -370,4 +370,36 @@ class PageTest < ActiveSupport::TestCase
     assert en_entry[:changed]
     refute en_entry[:exists_there]
   end
+
+  test "aggregate ignores order_by values outside the allowlist" do
+    sql = Page.aggregate(:order_by => "pages.id; DROP TABLE pages--").to_sql
+
+    assert_not_includes sql, "DROP"
+    assert_includes sql, "pages.id ASC"
+  end
+
+  test "aggregate accepts allowlisted order columns, bare or prefixed" do
+    assert_includes Page.aggregate(:order_by => "published_at").to_sql,
+                    "pages.published_at ASC"
+    assert_includes Page.aggregate(:order_by => "pages.published_at").to_sql,
+                    "pages.published_at ASC"
+  end
+
+  test "template_name rejects values not present in the template directory" do
+    page = Page.create!(:title => "Template guard")
+
+    page.template_name = "../../partials/_article"
+    assert_not page.valid?
+
+    page.template_name = "standard_template"
+    assert page.valid?
+  end
+
+  test "a stale legacy template_name does not block unrelated saves" do
+    page = Page.create!(:title => "Stale template")
+    page.update_column(:template_name, "long_deleted_template")
+
+    page.reload
+    assert page.update(:abstract => "still saveable")
+  end
 end