Lucas Fernandes Nogueira
3a9000177c
In plugins/fs/src/commands.rs resolve_path / is_forbidden, only paths that already existed were canonicalized, so a new file below a symlinked directory in the scope was matched by its unresolved path and written outside of the scope. Relative symlink targets were resolved against the process CWD, only the link target was checked against deny patterns, and resolution errors made is_forbidden fail open. resolve_path now computes the real path (canonical nearest existing ancestor + remaining components, following dangling symlinks relative to their parent, bounded to 40 links) and checks it against the allow and deny patterns; deny patterns also match the path as given. Resolution errors fail closed. Unit tests cover symlinked ancestors, relative and dangling links and loops.
Changes
via https://github.com/jbolda/covector
As you create PRs and make changes that require a version bump, please add a new markdown file in this folder. You do not note the version number, but rather the type of bump that you expect: major, minor, or patch. The filename is not important, as long as it is a .md, but we recommend that it represents the overall change for organizational purposes.
When you select the version bump required, you do not need to consider dependencies. Only note the package with the actual change, and any packages that depend on that package will be bumped automatically in the process.
Note, that in this repository, even if only the Rust code or only the JavaScript code of a plugin changed, both packages need to be bumped with the same increment!
Use the following format:
---
"package-a": patch
"package-b": minor:feat
---
Change summary goes here
Summaries do not have a specific character limit, but are text only. These summaries are used within the (future implementation of) changelogs. They will give context to the change and also point back to the original PR if more details and context are needed.
Changes will be designated as a major, minor or patch as further described in semver.
Given a version number MAJOR.MINOR.PATCH, increment the:
- MAJOR version when you make incompatible API changes,
- MINOR version when you add functionality in a backwards compatible manner, and
- PATCH version when you make backwards compatible bug fixes.
Additional labels for pre-release and build metadata are available as extensions to the MAJOR.MINOR.PATCH format, but will be discussed prior to usage (as extra steps will be necessary in consideration of merging and publishing).