lotobo/toolbox-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix: reject control characters in manifest URLs

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-20 18:02:16 +02:00
parent bc0135e528
commit 187871aae4
7 changed files with 152 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
schemas/toolbox-app.v1.schema.json
View File

@@ -164,6 +164,11 @@
{
"$ref": "#/$defs/nonEmptyString"
},
{
"type": "string",
"description": "URL references must not contain C0 control characters or DEL.",
"pattern": "^[^\\u0000-\\u001F\\u007F]*$"
},
{
"type": "string",
"description": "Backslashes are not URL path separators in toolbox documents.",
@@ -172,17 +177,17 @@
{
"type": "string",
"description": "Explicit schemes are limited to HTTP and HTTPS; relative references remain valid.",
"pattern": "^[\\t\\n\\r ]*(?:[Hh][Tt][Tt][Pp][Ss]?:|(?!(?:[A-Za-z][A-Za-z0-9+.-]*):))"
"pattern": "^ *(?:[Hh][Tt][Tt][Pp][Ss]?:|(?!(?:[A-Za-z][A-Za-z0-9+.-]*):))"
},
{
"type": "string",
"description": "An explicit HTTP(S) authority must not be empty.",
"pattern": "^(?![\\t\\n\\r ]*[Hh][Tt][Tt][Pp][Ss]?:/+(?:[?#]|$))"
"pattern": "^(?! *[Hh][Tt][Tt][Pp][Ss]?:/+(?:[?#]|$))"
},
{
"type": "string",
"description": "HTTP(S) authority references must not contain credentials.",
"pattern": "^[\\t\\n\\r ]*(?!(?:[Hh][Tt][Tt][Pp]:/*|[Hh][Tt][Tt][Pp][Ss]:/+|/+)[^/?#]*@)"
"pattern": "^ *(?!(?:[Hh][Tt][Tt][Pp]:/*|[Hh][Tt][Tt][Pp][Ss]:/+|/+)[^/?#]*@)"
}
]
},
@@ -194,12 +199,12 @@
{
"type": "string",
"description": "Repository URLs must be absolute HTTP(S) URLs.",
"pattern": "^[\\t\\n\\r ]*[Hh][Tt][Tt][Pp][Ss]?:/*[^\\s/?#]"
"pattern": "^ *[Hh][Tt][Tt][Pp][Ss]?:/*[^\\s/?#]"
},
{
"type": "string",
"description": "Absolute repository URLs must not contain credentials.",
"pattern": "^[\\t\\n\\r ]*(?![Hh][Tt][Tt][Pp][Ss]?:/*[^/?#]*@)"
"pattern": "^ *(?![Hh][Tt][Tt][Pp][Ss]?:/*[^/?#]*@)"
}
]
},

11
schemas/toolbox-catalog.v1.schema.json
View File

@@ -84,6 +84,11 @@
{
"$ref": "#/$defs/nonEmptyString"
},
{
"type": "string",
"description": "URL references must not contain C0 control characters or DEL.",
"pattern": "^[^\\u0000-\\u001F\\u007F]*$"
},
{
"type": "string",
"description": "Backslashes are not URL path separators in toolbox documents.",
@@ -92,17 +97,17 @@
{
"type": "string",
"description": "Explicit schemes are limited to HTTP and HTTPS; relative references remain valid.",
"pattern": "^[\\t\\n\\r ]*(?:[Hh][Tt][Tt][Pp][Ss]?:|(?!(?:[A-Za-z][A-Za-z0-9+.-]*):))"
"pattern": "^ *(?:[Hh][Tt][Tt][Pp][Ss]?:|(?!(?:[A-Za-z][A-Za-z0-9+.-]*):))"
},
{
"type": "string",
"description": "An explicit HTTP(S) authority must not be empty.",
"pattern": "^(?![\\t\\n\\r ]*[Hh][Tt][Tt][Pp][Ss]?:/+(?:[?#]|$))"
"pattern": "^(?! *[Hh][Tt][Tt][Pp][Ss]?:/+(?:[?#]|$))"
},
{
"type": "string",
"description": "HTTP(S) authority references must not contain credentials.",
"pattern": "^[\\t\\n\\r ]*(?!(?:[Hh][Tt][Tt][Pp]:/*|[Hh][Tt][Tt][Pp][Ss]:/+|/+)[^/?#]*@)"
"pattern": "^ *(?!(?:[Hh][Tt][Tt][Pp]:/*|[Hh][Tt][Tt][Pp][Ss]:/+|/+)[^/?#]*@)"
}
]
},