fix(manifest): reject namespace strings that are not safe path segments - #710

Merged

jeff-r2026 merged 27 commits into

Tencent:mainfrom

SaulMoro:fix/manifest-namespace-segments

Sep 23, 2026

Commits on Sep 23, 2026

fix(manifest): reject namespace strings that are not safe path segments
SaulMoro
committed
34c32b3
docs(changelog): note the manifest namespace guard
SaulMoro
committed
af2db67
fix(manifest): guard namespaces against traversal only, and say what is wrong
SaulMoro
committed
79fb8a4
fix(manifest): reject DEL and C1 controls in a namespace too
SaulMoro
committed
399eb8e
fix(manifest): reject the Win32 dot/space aliases of . and ..
SaulMoro
committed
a4f579e
fix(manifest): keep the project id rule untouched, scope the role docs
SaulMoro
committed
b52a3b1
docs(manifest): state the id and namespace rules separately
SaulMoro
committed
391bafd
fix(manifest): reject a namespace with a trailing '.' or space
SaulMoro
committed
bf0d79f
fix(pull): a roles manifest that does not parse must not widen delivery
SaulMoro
committed
d9c2747
fix(manifest): narrow 'absent' to ENOENT, refuse Windows device names
SaulMoro
committed
32efce7
fix(manifest): narrow every roles fallback, drop COM0/LPT0 from the device set
SaulMoro
committed
83cb66c
fix(manifest): prove absence before trusting it, add the superscript devices
SaulMoro
committed
b7bb7b2
fix(init): a broken roles manifest must stop init, a skipped prompt must not
SaulMoro
committed
4ea91e2
chore(ci): re-run review against the rebased head
SaulMoro
committed
0f478c3
fix(manifest): expand '~' when reading a manifest, guard role ids used as fallback namespaces
SaulMoro
committed
45fd115
fix(config): expand '~' in repo.localPath at the config boundary
SaulMoro
committed
afef8b6
fix(manifest): reject the CONIN$ and CONOUT$ console devices too
SaulMoro
committed
9bee58c
fix(push): guard the role id silent mode uses as a namespace
SaulMoro
committed
ff05b3e
fix(manifest): reject namespaces that differ only by case, classify the guard as breaking
SaulMoro
committed
27112c8
fix(pull): check roles.yaml against projects.yaml for role-less members too
SaulMoro
committed
d606798
fix(manifest): fold case the way filesystems do when comparing namespaces
SaulMoro
committed
1ce9c4c
fix(config): keep the config loadable when the roles manifest is broken
SaulMoro
committed
e6ef558
fix(status): report a resource type it cannot scan instead of crashing
SaulMoro
committed
2d0bb35
fix(status): do not report "(none)" when a resource type could not be scanned
SaulMoro
committed
0f80dcc
fix(config): a role the manifest could not resolve matches no role-scoped entry
SaulMoro
committed
2965e4d
Merge origin/main into fix/manifest-namespace-segments
SaulMoro
committed
736710c
Merge remote-tracking branch 'origin/main' into fix/manifest-namespace-segments
SaulMoro
committed
f3f8dcd

Navigation Menu

fix(manifest): reject namespace strings that are not safe path segments - #710

fix(manifest): reject namespace strings that are not safe path segments#710
jeff-r2026 merged 27 commits into
Tencent:mainfrom
SaulMoro:fix/manifest-namespace-segments

Commits on Sep 23, 2026

fix(manifest): reject namespace strings that are not safe path segments

docs(changelog): note the manifest namespace guard

fix(manifest): guard namespaces against traversal only, and say what is wrong

fix(manifest): reject DEL and C1 controls in a namespace too

fix(manifest): reject the Win32 dot/space aliases of . and ..

fix(manifest): keep the project id rule untouched, scope the role docs

docs(manifest): state the id and namespace rules separately

fix(manifest): reject a namespace with a trailing '.' or space

fix(pull): a roles manifest that does not parse must not widen delivery

fix(manifest): narrow 'absent' to ENOENT, refuse Windows device names

fix(manifest): narrow every roles fallback, drop COM0/LPT0 from the device set

fix(manifest): prove absence before trusting it, add the superscript devices

fix(init): a broken roles manifest must stop init, a skipped prompt must not

chore(ci): re-run review against the rebased head

fix(manifest): expand '~' when reading a manifest, guard role ids used as fallback namespaces

fix(config): expand '~' in repo.localPath at the config boundary

fix(manifest): reject the CONIN$ and CONOUT$ console devices too

fix(push): guard the role id silent mode uses as a namespace

fix(manifest): reject namespaces that differ only by case, classify the guard as breaking

fix(pull): check roles.yaml against projects.yaml for role-less members too

fix(manifest): fold case the way filesystems do when comparing namespaces

fix(config): keep the config loadable when the roles manifest is broken

fix(status): report a resource type it cannot scan instead of crashing

fix(status): do not report "(none)" when a resource type could not be scanned

fix(config): a role the manifest could not resolve matches no role-scoped entry

Merge origin/main into fix/manifest-namespace-segments

Merge remote-tracking branch 'origin/main' into fix/manifest-namespace-segments