Repository navigation
fix(download): accept native ZIP parent trailing slash - #47
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Etech always posts non-root ZIP parent directories with a trailing slash. The scoped ZIP issuer rejected that native directory form before object and ACL validation, causing both a selected folder and two selected files to return HTTP 500.
Remove one optional trailing parent separator before canonical validation and scope binding. Double separators, traversal, missing objects and ACL denial remain rejected. This changes only the ZIP issuer (8 added lines, 1 removed line).
Validation: reproduced the failure against the merged PR #46 source, then compiled/exercised the real token-manager functions with isolated native dependencies. Eight probe groups pass with explicit folder/multi trailing-slash cases and double-slash/traversal rejection. No full build, environment change or DEV deployment performed; real DEV acceptance remains pending deployment.
Review also verifies that a doubled root separator (
//) remains rejected instead of being normalized to root.