actions/setup-ruby
1
0
Fork 0
mirror of https://github.com/ruby/setup-ruby.git synced 2026-09-13 06:34:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Match more strictly with \A and \z

Browse Source
This commit is contained in:
Benoit Daloze
2026-01-13 11:06:41 +01:00
parent b939495830
commit 3fc6249beb
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
generate-windows-versions.rb
+6 -6
View File
@@ -8,20 +8,20 @@ require 'json'
# - Each path component must begin with [\w], or a more restrictive character set.
# - Percent (`%`) shall not be allowed to avoid any percent encoding.
WINDOWS_VERSIONS_URLS_REGEXPS = [
%r{^https://github\.com/oneclick/rubyinstaller2?/releases/download/\w[\w.-]*/\w[\w.-]*$},
%r{^https://github\.com/MSP-Greg/ruby-loco/releases/download/\w[\w.-]*/\w[\w.-]*$}
%r{\Ahttps://github\.com/oneclick/rubyinstaller2?/releases/download/\w[\w.-]*/\w[\w.-]*\z},
%r{\Ahttps://github\.com/MSP-Greg/ruby-loco/releases/download/\w[\w.-]*/\w[\w.-]*\z}
].freeze
WINDOWS_TOOLCHAIN_VERSIONS_URLS_REGEXPS = [
%r{^https://github\.com/oneclick/rubyinstaller/releases/download/devkit-4\.7\.2/DevKit-mingw64-64-4\.7\.2-20130224-1432-sfx\.exe$},
%r{^https://github\.com/ruby/setup-msys2-gcc/releases/download/\w[\w.-]*/\w[\w@.-]*$},
%r{^https://github\.com/ruby/setup-msys2-gcc/releases/latest/download/\w[\w@.-]*$}
%r{\Ahttps://github\.com/oneclick/rubyinstaller/releases/download/devkit-4\.7\.2/DevKit-mingw64-64-4\.7\.2-20130224-1432-sfx\.exe\z},
%r{\Ahttps://github\.com/ruby/setup-msys2-gcc/releases/download/\w[\w.-]*/\w[\w@.-]*\z},
%r{\Ahttps://github\.com/ruby/setup-msys2-gcc/releases/latest/download/\w[\w@.-]*\z}
].freeze
# Validate all the URLs in the versions json
def validate(versions, allowed_urls_regexps)
versions.values.flat_map(&:values).each do |url|
if allowed_urls_regexps.none? { |regexp| regexp =~ url }
if allowed_urls_regexps.none? { |regexp| regexp.match? url }
raise SecurityError, "Unexpected URL: #{url}"
end
end