Harden Windows package paths (T-605)

2026-07-16 23:56:19 +08:00
parent f7a803d944
commit 6fd19d0f43
19 changed files with 664 additions and 108 deletions
@@ -46,7 +46,8 @@
        "path": {
          "type": "string",
          "minLength": 1,
-          "pattern": "^(?!/)(?!.*\\\\)(?!.*:)(?!\\.\\.?(/|$)).+$"
+          "$comment": "Runtime validation additionally rejects invalid UTF-8/control characters and Windows reserved device names; this pattern is only a basic shape constraint.",
+          "pattern": "^(?!/)(?! )(?!.*(/ ))(?!.*\\\\)(?!.*[:<>\"|?*])(?!\\.\\.?(/|$))(?!.*(/\\.\\.?)(/|$))(?!.*//)(?!.*[ .](/|$)).+$"
        },
        "size": {
          "type": "integer",