Restrict mrpack path format syntax #45
nothub
started this conversation in
Feature requests
Replies: 2 comments
-
That'd be a breaking change. I think this would warrant a |
Beta Was this translation helpful? Give feedback.
0 replies
-
An example of It should be evaluated if |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Is your suggested enhancement related to a problem? Please describe.
Currently, there is no restriction for the path format of files in a mrpacks manifest.
In the docs there are examples for avoiding path traversal attacks:
[A-Z]:/
,[A-Z]:\
, and/
. From this I understand that the path format syntax is not restricted to a common type.By not restricting the path format syntax, the interpretation of paths defined in mrpack files will slightly differ between tools because the developers can implement it on their own discretion.
In the long term, this will lead to a path format syntax that is restricted by the community, based on the paths interpretation of popular tooling.
Describe the solution you'd like
I suggest restricting the allowed path syntax to solely unix path syntax.
Describe alternatives you've considered
No response
Additional context
Related to #84
Conversation on Discord:
[15:44] Emma (triphora): It should probably only be /
[15:44] Emma (triphora): Could you make a docs issue?
Beta Was this translation helpful? Give feedback.
All reactions