eric/ReleaseKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Resolve absolute destinations inside the candidate checkout

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-07 20:29:16 +00:00
parent 9d2ca66a79
commit 1dfa774164
4 changed files with 117 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/roadmap/remediation.md
View File

@@ -1,6 +1,6 @@
# Shared validation foundation remediation
Status: Remediation in progress; findings 1–4 addressed, findings 5–6 pending.
Status: Remediation in progress; findings 1–5 addressed, finding 6 pending.
Reviewed committed implementation `f53354b`, covering the eight foundation
commits after `0c7129a`, against the [implementation plan](implementation.md),
@@ -175,6 +175,13 @@ complete message wording as a contract.
## 5. P2: Absolute paths inside the checkout are classified as outside
**Resolution:** Addressed. Absolute destinations and symlink targets within the
captured repository directory map to candidate paths before component
traversal. Absolute paths with similar external prefixes remain outside.
Regression tests also retain symlink-before-parent semantics and demonstrate
that removed committed files resolve while live-only files remain missing.
`go test ./internal/validation` passed.
**Owner:** [candidate destination resolver](../../internal/validation/tree.go),
the absolute-destination and absolute-symlink branches.