spark-store-project/spark-store
15
0
Fork 0
mirror of https://gitee.com/spark-store-project/spark-store synced 2026-09-20 21:50:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(install-manager): 按 dpkg 规则放宽 deb 文件名校验，修复含 epoch 冒号包被误拦

Browse Source 
- 新增 FILENAME_PATTERN，按 Debian 规则允许包名/版本号合法字符：含 epoch 冒号
  （如 steam-launcher_1:1.0.0.87_amd64.deb）与排序标记 ~（如 1.0~beta），及字母数字 . _ + -
- filename 校验由严格 PKGNAME_PATTERN 改为 FILENAME_PATTERN，并保留路径遍历双保险
  （拒绝 '..' 段 + path.basename 拒绝含 '/' 的路径），安全性未削弱
- 修正字符组内 [:~] 正则区间陷阱：用 \- 转义隔离，避免误匹配 <,=,>,?,@,[,] 等符号
- 已用真实仓库 2085 个包验证：包名/文件名拒绝均为 0，全部可正常放行下载与安装
This commit is contained in:
xiyidaiwa
2026-08-17 09:12:08 +08:00
parent ae9142ad06
commit ada3a6dab4
2 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
debian/changelog
Vendored
+1 -1
View File
@@ -1,4 +1,4 @@
spark-store (5.3.0) UNRELEASED; urgency=medium
spark-store (5.2.1.0) UNRELEASED; urgency=medium
* Initial release.