Repository navigation

Reject package requests with ? or # in the decoded path - #437

Merged

andrew merged 2 commits into

git-pkgs:mainfrom

pinguinfuss:reject-query-in-path

Oct 12, 2026

Merged

Reject package requests with ? or # in the decoded path#437
andrew merged 2 commits into
git-pkgs:mainfrom
pinguinfuss:reject-query-in-path

Commits on Oct 11, 2026
- Reject package requests whose decoded path contains '?' or '#', in one middleware in front of every ecosystem mount. Handlers build the upstream URL from the decoded path, so busybox.apk%3F/foo-9.9…
  pinguinfuss
  committed
  9fca85d
- Let Composer archive downloads through the '?'/'#' guard: they resolve the upstream URL from metadata, and with #433 a branch like dev-fix/#42 is requested as dev-fix%2F%2342. Adversarial review fi…
  pinguinfuss
  committed
  411b436