tests: guard botlib bounded string regressions

[cursor]

Summary

• Add a deterministic script regression test for recent botlib bounded string fixes across Unix and Win32 platform copies.
• Register the test with CTest and document it in tests/README.md.

Risky behavior now covered

• BotLoadChatMessage must keep length preflight checks and bounded Q_strncpyz/Com_sprintf writes for fixed strings, numeric variables, and random string references.
• SourceError/SourceWarning must keep bounded Q_vsnprintf formatting.
• #eval/$eval parser token formatting must keep bounded Com_sprintf(token.string, MAX_TOKEN, ...) calls.

Test files added/updated

• Added tests/scripts/test_botlib_bounded_strings.sh
• Updated CMakeLists.txt
• Updated tests/README.md

Why this reduces regression risk

These botlib parser/chat paths consume script/chat data and exist in duplicated platform trees, so reverting to unbounded formatting or drifting one platform copy would create memory-safety risk with broad engine impact. The new source-level regression test is fast, deterministic, and checks both copies for the specific bounded APIs and size guards introduced by the recent audit work.

Validation

• tests/scripts/test_botlib_bounded_strings.sh
• cmake -S . -B build-coverage-tests -DBUILD_UNIT_TESTS=OFF -DBUILD_EXAMPLE_DEMO_GAME=OFF
• ctest --test-dir build-coverage-tests -R test_botlib_bounded_strings --output-on-failure

  

[cursor]

Stale comment

Security review complete: no medium-or-higher confidence vulnerabilities found in the added/modified code.

Scope reviewed: new CTest wiring, tests/README.md, and tests/scripts/test_botlib_bounded_strings.sh. The new script reads fixed repository source files and checks bounded string invariants; I did not find an attacker-controlled path to injection, authz bypass, secret exposure, unsafe deserialization, path traversal, or other security sink. No prior automation review threads were present to re-report.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Security review complete: no medium-or-higher confidence vulnerabilities found in the added or modified code.

Scope reviewed: new CTest wiring in CMakeLists.txt, tests/README.md, and tests/scripts/test_botlib_bounded_strings.sh. The executable change is a local regression checker that reads fixed repository source files and uses quoted paths into inline Python; I did not find an attacker-controlled path to injection, authz bypass, secret exposure, SSRF, path traversal, unsafe deserialization, or another security sink.

Validation: tests/scripts/test_botlib_bounded_strings.sh passed locally. No prior review threads were present to re-report.

  

_{Sent by Cursor Automation: Find vulnerabilities}