From 4907e59a7ebd1318f2b3cffa540b10ae2279d84f Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Mon, 11 May 2026 01:23:55 +0300 Subject: ci(ai-validation): fix control-char guard — use grep -z, exclude NUL MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previous form `tr -d '\0\n\r' | grep -Pq [\x00-\x1F\x7F]` stripped the very chars (LF, CR) it was meant to catch before the grep ran, so a path containing newlines or carriage returns slipped through. `grep -z` keeps NUL as the record delimiter (legitimate separator from git diff -z) and the pattern excludes 0x00 while catching every other control byte 0x01-0x1F + 0x7F. LF/CR inside any path now correctly fail the guard. Surfaced by Copilot on #1969; applied to all three branch copies (rolling/circinus/sagitta) so the workflow stays in sync. 🤖 Generated by [robots](https://vyos.io) --- .github/workflows/ai-validation.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to '.github/workflows') diff --git a/.github/workflows/ai-validation.yml b/.github/workflows/ai-validation.yml index 1265b789..ea16a4fb 100644 --- a/.github/workflows/ai-validation.yml +++ b/.github/workflows/ai-validation.yml @@ -77,9 +77,15 @@ jobs: # coverage on the real file (or worse, attempt to act on a synthetic # path). Filesystems and porcelain git typically reject these but a # fork PR can still commit such a tree entry; fail fast. + # grep -z treats NUL as the record delimiter (NUL is a legitimate + # separator here, not a forbidden char). The pattern excludes + # 0x00 and rejects every other control byte 0x01-0x1F + 0x7F, + # so LF (0x0A) and CR (0x0D) inside a path are caught. + # An earlier `tr -d '\0\n\r' | grep [\x00-\x1F\x7F]` form would + # strip the very chars it was meant to reject before the grep + # ran — defeating the guard. for z in changed-md.z changed-rst.z; do - if LC_ALL=C tr -d '\0\n\r' < "$z" \ - | LC_ALL=C grep -Pq '[\x00-\x1F\x7F]'; then + if LC_ALL=C grep -zPq '[\x01-\x1F\x7F]' "$z"; then echo "::error::Refusing to bundle: path in $z contains a control character. Reject the offending file name in the PR." exit 1 fi -- cgit v1.2.3