fix(10.1-04): refuse percent-encoded dot segments in plugin asset URLs

Browse Source

The URL parser resolves %2e%2e like .., so /{base}/assets/%2e%2e/api/...
passed assetAllowed and would load from outside the asset prefix. A
segment is now a dot segment after decoding %2e, in any case.

- tests/app/pluginAssets.test.ts covers the URL check, loadScript,
  loadStyles, activateStyles and loadControllerAssets
- modules/boardwalk/dist rebuilt

...

This commit is contained in:

Jakub Zych

2026-09-29 02:52:14 +02:00

parent 7eed4acd87

commit 6b0ac15086

4 changed files with 211 additions and 4 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

4

modules/boardwalk/dist/assets/index-B51qJou6.js vendored Normal file

File diff suppressed because one or more lines are too long