File paths in the manifest have no documented or enforced invariants. This is both a security issue (path traversal via ..) and a cross-platform compatibility issue (macOS NFD vs Linux NFC, backslashes on Windows).
Specify in proto comments and enforce in code:
UTF-8 encoded
Forward-slash separators only
Relative paths (no leading /)
No .. components
No empty path segments (foo//bar)
Validation should happen in Builder.AddFile and Builder.AddFileWithHash. Invalid paths should return an error.
**Phase 1 item from #10**
File paths in the manifest have no documented or enforced invariants. This is both a security issue (path traversal via `..`) and a cross-platform compatibility issue (macOS NFD vs Linux NFC, backslashes on Windows).
Specify in proto comments and enforce in code:
- UTF-8 encoded
- Forward-slash separators only
- Relative paths (no leading `/`)
- No `..` components
- No empty path segments (`foo//bar`)
Validation should happen in `Builder.AddFile` and `Builder.AddFileWithHash`. Invalid paths should return an error.
clawbot
self-assigned this 2026-02-09 01:05:42 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Phase 1 item from #10
File paths in the manifest have no documented or enforced invariants. This is both a security issue (path traversal via
..) and a cross-platform compatibility issue (macOS NFD vs Linux NFC, backslashes on Windows).Specify in proto comments and enforce in code:
/)..componentsfoo//bar)Validation should happen in
Builder.AddFileandBuilder.AddFileWithHash. Invalid paths should return an error.