Skip to content

Commit a455ce7

Browse files
committed
📝 Add logging for unsafe exclude patterns in copy script to enhance security checks
1 parent b4ddaea commit a455ce7

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

‎lib/copy.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,7 @@ copy_directories(){
225225
esac
226226

227227
# Match full path (supports glob patterns like node_modules/.cache or */cache)
228+
# Intentionally unquoted for glob pattern matching (shellcheck SC2254)
228229
case"$dir_path"in
229230
$exclude_pattern)
230231
excluded=1
@@ -263,6 +264,7 @@ EOF
263264
# Security: reject absolute paths and parent directory traversal in excludes
264265
case"$exclude_pattern"in
265266
/*|*/../*|../*|*/..|..)
267+
log_warn "Skipping unsafe exclude pattern: $exclude_pattern"
266268
continue
267269
;
268270
esac

0 commit comments

Comments
(0)