Test/coverage batch 1

.github/workflows/ci-cd.yml

@@ -51,12 +51,16 @@ jobs:
       # (LagersystemLVHome, the Blazor Server UI project, is excluded - no unit-test
       # practice on Razor markup here). Downloaded and committed by semantic-release below.
       - run: dotnet tool install -g dotnet-reportgenerator-globaltool
+      # -*.g.cs excludes source-generator output (e.g. the LoggerMessage generator's
+      # 700+ lines under obj/) - generated code, same rationale as studylife's
+      # migrations exclusion.
       - run: >
           reportgenerator
           -reports:"LagersystemLVHome.UnitTests/**/TestResults/**/coverage.cobertura.xml"
           -targetdir:coverage-summary
           -reporttypes:JsonSummary
           -assemblyfilters:"-LagersystemLVHome"
+          -filefilters:"-*.g.cs"
       - run: python3 scripts/generate_coverage_badge.py coverage-summary/Summary.json coverage-badge.json
       - uses: actions/upload-artifact@v7
         with:

LagersystemLVHome.Application/Services/Inventory/ImageService.cs

@@ -374,7 +374,11 @@ private void ValidateFileSignature(MemoryStream stream, string extension, string
             throw new InvalidOperationException($"Keine Signatur-Validierung f\u00fcr {extension} definiert");
         }
 
-        var headerBytes = new byte[signatures.Max(s => s.Length)];
+        // At least 12 bytes: the WebP check below needs the "WEBP" marker at offset 8-11,
+        // but .webp's only signature entry is the 4-byte RIFF header - sizing the buffer
+        // purely by signature length capped bytesRead at 4 and made the `bytesRead >= 12`
+        // guard unconditionally false, rejecting EVERY WebP upload including valid ones.
+        var headerBytes = new byte[Math.Max(12, signatures.Max(s => s.Length))];
         var bytesRead = stream.Read(headerBytes, 0, headerBytes.Length);
 
         var isValid = signatures.Any(signature =>