mattcasters commented on PR #8306:
URL: https://github.com/apache/hop/pull/8306#issuecomment-5652972761

   Thanks for re-checking, @bamaer — item 3 is closed now.
   
   `relativePath()` was still feeding `sanitizeRelativePath()` the URI-escaped 
output of `FileName.getRelativeName()`, so `100% done.html` became 
`100%2525%20done.html` after `buildPublicPath` and never hit the real file.
   
   It now decodes with `UriParser.decode()` first, matching the already-decoded 
contract. Tests start from a real `FileObject` (`100% done.html` and 
`a%20b.html`), build the public URL, simulate the container decoding path-info 
once, and resolve back to the same file. Servlet coverage does the same 
end-to-end.
   
   On `js`/`mjs`: they stay on the allow-list. The original ticket listed `js` 
for documentation trees that ship scripts next to HTML. The pragmatic CSP 
(`connect-src 'none'; form-action 'none'; base-uri 'none'`) is what blocks 
those scripts from calling Hop APIs; dropping the extensions would 404 
legitimate docs assets.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to