Harden Windows package paths (T-605)

2026-07-16 23:56:19 +08:00
parent f7a803d944
commit 6fd19d0f43
19 changed files with 664 additions and 108 deletions
@@ -84,7 +84,8 @@
    "safeRelativePath": {
      "type": "string",
      "minLength": 1,
-      "pattern": "^(?!/)(?!.*\\\\)(?!.*:)(?!\\.\\.?(/|$)).+$"
+      "$comment": "Runtime validation additionally rejects invalid UTF-8/control characters and Windows reserved device names; this pattern is only a basic shape constraint.",
+      "pattern": "^(?!/)(?! )(?!.*(/ ))(?!.*\\\\)(?!.*[:<>\"|?*])(?!\\.\\.?(/|$))(?!.*(/\\.\\.?)(/|$))(?!.*//)(?!.*[ .](/|$)).+$"
    }
  }
 }