Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security: file name restriction #2768

Merged
merged 1 commit into from
Jan 22, 2025

Conversation

Ludy87
Copy link
Contributor

@Ludy87 Ludy87 commented Jan 21, 2025

Description of Changes

This PR updates the check_properties.yml workflow to refine the file-matching regex for properties files.

What was changed:

  • Modified the regex used in two locations:
    1. In the GitHub CLI (gh) command to filter changed files:
      - '^src/main/resources/messages_[a-zA-Z_]+\.properties$'
      + '^src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$'
    2. In the code to match relevant property files:
      - /^src\/main\/resources\/messages_[a-zA-Z_]+\.properties$/
      + /^src\/main\/resources\/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$/

Why the change was made:

  • The previous regex matched any property files with loosely defined patterns, including invalid or unintended formats.
  • The updated regex ensures stricter matching of valid locale patterns:
    • Locale codes in the format xx_XX where:
      • xx represents a 2-character language code.
      • XX represents a 2-7 character region code.

Challenges encountered:

  • Ensuring compatibility across both the GitHub CLI command.
  • Avoiding edge cases where valid property files might be excluded unintentionally.

Closes # (issue_number)


Checklist

General

Documentation

UI Changes (if applicable)

  • Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR)

Testing (if applicable)

  • I have tested my changes locally. Refer to the Testing Guide for more details.

@dosubot dosubot bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Jan 21, 2025
@Frooodle Frooodle enabled auto-merge (squash) January 21, 2025 21:21
@Frooodle Frooodle disabled auto-merge January 22, 2025 10:41
@Frooodle Frooodle merged commit 7865bf7 into Stirling-Tools:main Jan 22, 2025
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Github size:XS This PR changes 0-9 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants