Incoming label for token `...` must not contain slashes or backslashes: `bla/bla` #111

New issue

Open

opened 2025-08-28 10:27:01 +00:00 by mih · 2 comments

mih commented

2025-08-28 10:27:01 +00:00

(Migrated from github.com)

I wonder why that needs to be restricted. It makes sense to prevent escaping, and it makes sense to prevent ../ placement. However, preventing any hierarchical organization implies a potentially overpopulated directory, and any and all incoming areas must be direct children.

I wonder why that needs to be restricted. It makes sense to prevent escaping, and it makes sense to prevent `../` placement. However, preventing any hierarchical organization implies a potentially overpopulated directory, and any and all incoming areas must be direct children.

christian-monch commented

2025-09-02 12:23:36 +00:00

(Migrated from github.com)

Since we control the incoming label, we could lift those restrictions. I would add a check to ensure the resulting directory is located below the incoming directory.

mih commented

2025-09-02 12:33:55 +00:00

(Migrated from github.com)

Great, thanks!