Files
rea/src/application/javascript
Kaoru0822andClaude Opus 5.5 fb57c8643f fix(javascript): reject encoded separators joined by HTML URL whitespace
#1287 removes URL tabs and newlines from an HTML script URL before
percent-decoding. A declaration such as %2<newline>fapp.js passed the
raw admission check and then decoded to a separator, resolving to a
file the encoded-separator rule must refuse. Apply canonical path
admission again to the parsed URL text.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-09 14:18:39 +00:00
..