fix(snapshot s3): reject object keys with ".." segments and never overwrite a downloaded object - #1155

Merged

AlexKantor87 merged 14 commits into

mainfrom

6781-s3-key-containment

Sep 10, 2026

Commits on Sep 9, 2026

fix(snapshot s3): reject object keys with ".." segments and never overwrite a downloaded object
AlexKantor87
committed
4e8a638
test(snapshot s3): pin the object-key containment rule
AlexKantor87
committed
9bb9ea5
docs(snapshot s3): state the object-key rule
AlexKantor87
committed
456f075
fix(snapshot s3): count ".. " and "..." as ".." segments and point at --exclude-regex
AlexKantor87
committed
9b0e634
Merge remote-tracking branch 'origin/main' into 6781-s3-key-containment
AlexKantor87
committed
ec7619f
fix(snapshot s3): name the object key when a download collides or its directory cannot be made
AlexKantor87
committed
d77b4eb
fix(snapshot s3): only advise excluding a key when the key is the cause
AlexKantor87
committed
11e4a0f
docs(snapshot s3): say that include filters override exclude when advising on a rejected key
AlexKantor87
committed
5d37f00
fix(snapshot s3): advise on an object-and-prefix clash and name the key on download failure
AlexKantor87
committed
a270b52
test(snapshot s3): say a segment resolves to "..", skip the chmod test on Windows, pin the overwrite message
AlexKantor87
committed
e81d898
test(snapshot s3): assert the Windows-only rejections per OS; note that --exclude-regex needs escaping
AlexKantor87
committed
bed7567
test(aws): pin lexicographic ListObjectsV2 order in the S3 contract suite
AlexKantor87
committed
4a2370b
test(aws): check listing order across pages and cover the MkdirAll error wrap
AlexKantor87
committed
b9cc318
refactor(snapshot s3): hold the new comments to the comment standard
AlexKantor87
committed
59799e1

Navigation Menu

Uh oh!

fix(snapshot s3): reject object keys with ".." segments and never overwrite a downloaded object - #1155

fix(snapshot s3): reject object keys with ".." segments and never overwrite a downloaded object#1155
AlexKantor87 merged 14 commits into
mainfrom
6781-s3-key-containment

Commits on Sep 9, 2026

fix(snapshot s3): reject object keys with ".." segments and never overwrite a downloaded object

test(snapshot s3): pin the object-key containment rule

docs(snapshot s3): state the object-key rule

fix(snapshot s3): count ".. " and "..." as ".." segments and point at --exclude-regex

Merge remote-tracking branch 'origin/main' into 6781-s3-key-containment

fix(snapshot s3): name the object key when a download collides or its directory cannot be made

fix(snapshot s3): only advise excluding a key when the key is the cause

docs(snapshot s3): say that include filters override exclude when advising on a rejected key

fix(snapshot s3): advise on an object-and-prefix clash and name the key on download failure

test(snapshot s3): say a segment resolves to "..", skip the chmod test on Windows, pin the overwrite message

test(snapshot s3): assert the Windows-only rejections per OS; note that --exclude-regex needs escaping

test(aws): pin lexicographic ListObjectsV2 order in the S3 contract suite

test(aws): check listing order across pages and cover the MkdirAll error wrap

refactor(snapshot s3): hold the new comments to the comment standard