易良
|
3bf2d45403
|
ci: add suspicious comment attachment guard (#6599)
* ci: add suspicious comment attachment guard
Resolves #6597
* ci: reduce attachment guard false positives
* ci: harden comment attachment guard
* ci: tighten attachment extension matching
* ci: avoid false attachment removal summary
* ci: avoid markdown link attachment false positives
* ci: avoid country-code attachment false positives
* ci: harden attachment URL parsing
* ci: reduce attachment guard false positives
Updates #6597
* ci: harden malformed attachment URLs
Updates #6597
* ci: reduce attachment guard overmatching
Updates #6597
* ci: scan attachment path segments
Updates #6597
* ci: cover review attachment summaries
* ci: harden attachment link detection
* fix: address critical bypass vectors in comment attachment guard
- Remove break in decodeTarget catch block so malformed percent sequences
(e.g., %ZZ) don't prematurely exit the decode loop, allowing
double-encoded extensions to be fully detected
- Strip zero-width characters (U+200B-U+200D, U+FEFF, U+00AD, U+2060,
U+180E) before NFKC normalization to prevent invisible-character
evasion of extension matching
- Add protocol-relative URL (//) support to linkPattern and
highRiskTarget, normalizing to https: before parsing
- Add tests for all three bypass vectors (39 total, all passing)
---------
Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com>
|
2026-07-10 09:40:54 +00:00 |
|