Skip to content

T025: Tighten allowed-paths regex patterns#3

Merged
grobomo merged 1 commit intomainfrom
001-T025-tighten-allowed-paths
Apr 4, 2026
Merged

T025: Tighten allowed-paths regex patterns#3
grobomo merged 1 commit intomainfrom
001-T025-tighten-allowed-paths

Conversation

@grobomo
Copy link
Copy Markdown
Owner

@grobomo grobomo commented Apr 4, 2026

Summary

  • /test/i matched 'test' anywhere in path (e.g. directory names). Tightened to [/\]tests?[/\]
  • Same fix for /config/i and /install/i — now require directory boundaries or file extensions
  • 28/28 e2e tests still pass

Test plan

  • 28/28 e2e proof tests pass

/test/i matched 'test' anywhere in path (e.g. 'contest/', directory
names containing 'test'). Same issue with /config/i and /install/i.
Tightened to require directory boundaries or file extensions.
@grobomo grobomo merged commit 2d17a32 into main Apr 4, 2026
1 check passed
@grobomo grobomo deleted the 001-T025-tighten-allowed-paths branch April 4, 2026 02:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant