From c133acb332e92e53ef2f32faa91a51666e6f89b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Sun, 27 Sep 2026 13:21:18 +0200
Subject: [PATCH] test(import): stage the zip-bomb extraction in the test's own
 directory

The test diffed the shared system tmpdir before and after the extraction,
and other test files extracting in parallel stage their files there too,
so it failed on their files rather than its own. TMPDIR now points at a
directory of the test's own for the call.
---
 .../import/__tests__/unzip-export-xml.test.ts | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/src/lib/import/__tests__/unzip-export-xml.test.ts b/src/lib/import/__tests__/unzip-export-xml.test.ts
index ff9dfc064..5ffef71ef 100644
--- a/src/lib/import/__tests__/unzip-export-xml.test.ts
+++ b/src/lib/import/__tests__/unzip-export-xml.test.ts
@@ -187,12 +187,20 @@ describe("extractExportXml", () => {
     const tmp = mkdtempSync(join(tmpdir(), "healthlog-unzip-"));
     const zipPath = join(tmp, "export.zip");
     writeFileSync(zipPath, zip);
-    const staged = () =>
-      readdirSync(tmpdir()).filter((n) => n.startsWith("healthlog-import-"));
-    const before = new Set(staged());
-
-    await expect(extractExportXml(zipPath)).rejects.toThrow(/zip bomb/);
-    expect(staged().filter((n) => !before.has(n))).toEqual([]);
+    // Staged into a directory of this test's own. The shared system tmpdir
+    // also holds whatever other test files extracting in parallel have
+    // staged at that moment, and a before/after diff over it failed on
+    // their files, not this one's.
+    const staging = mkdtempSync(join(tmpdir(), "healthlog-unzip-staging-"));
+    const previousTmpdir = process.env.TMPDIR;
+    process.env.TMPDIR = staging;
+    try {
+      await expect(extractExportXml(zipPath)).rejects.toThrow(/zip bomb/);
+    } finally {
+      if (previousTmpdir === undefined) delete process.env.TMPDIR;
+      else process.env.TMPDIR = previousTmpdir;
+    }
+    expect(readdirSync(staging)).toEqual([]);
     // Inflating past the 64 MiB floor takes a moment on a loaded runner.
   }, 60_000);