mattcasters commented on PR #8306: URL: https://github.com/apache/hop/pull/8306#issuecomment-5652972761
Thanks for re-checking, @bamaer — item 3 is closed now. `relativePath()` was still feeding `sanitizeRelativePath()` the URI-escaped output of `FileName.getRelativeName()`, so `100% done.html` became `100%2525%20done.html` after `buildPublicPath` and never hit the real file. It now decodes with `UriParser.decode()` first, matching the already-decoded contract. Tests start from a real `FileObject` (`100% done.html` and `a%20b.html`), build the public URL, simulate the container decoding path-info once, and resolve back to the same file. Servlet coverage does the same end-to-end. On `js`/`mjs`: they stay on the allow-list. The original ticket listed `js` for documentation trees that ship scripts next to HTML. The pragmatic CSP (`connect-src 'none'; form-action 'none'; base-uri 'none'`) is what blocks those scripts from calling Hop APIs; dropping the extensions would 404 legitimate docs assets. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
