fix(toolchain)!: restrict named toolchain characters - #4932
Open
cachebag wants to merge 2 commits into
Open
Conversation
Contributor
Author
|
Note to myself that this will probably need some corrections once #4930 is merged |
cachebag
force-pushed
the
main
branch
4 times, most recently
from
June 30, 2026 14:11
1318f92 to
9118fcc
Compare
djc
reviewed
Jun 30, 2026
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Member
|
@cachebag Thanks for this PR! I think given your comment in #4932 (comment) I'll probably review #4930 first and come back to this one later, many thanks for your understanding 🙏 |
djc
reviewed
Jun 30, 2026
cachebag
force-pushed
the
main
branch
7 times, most recently
from
June 30, 2026 21:07
86f5e64 to
b8c8bb9
Compare
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
cachebag
force-pushed
the
main
branch
4 times, most recently
from
June 30, 2026 23:07
913f977 to
a8ed506
Compare
rami3l
reviewed
Jul 1, 2026
djc
approved these changes
Jul 1, 2026
rami3l
changed the title
cachebag
force-pushed
the
main
branch
2 times, most recently
from
July 1, 2026 23:59
b1e3812 to
39fbbcc
Compare
Member
|
@cachebag Sorry for the delay in reviewing! I have to see if the current code can be further streamlined and what we should do about #4059 (comment). Please stay tuned... |
cachebag
marked this pull request as draft
July 6, 2026 01:26
cachebag
force-pushed
the
main
branch
6 times, most recently
from
July 13, 2026 13:01
8e4516c to
39f608c
Compare
cachebag
force-pushed
the
main
branch
3 times, most recently
from
July 20, 2026 00:46
d14a77d to
4259f6e
Compare
This comment has been minimized.
This comment has been minimized.
cachebag
force-pushed
the
main
branch
3 times, most recently
from
August 3, 2026 14:24
417f74c to
028f723
Compare
cachebag
marked this pull request as ready for review
August 3, 2026 14:40
rami3l
reviewed
Aug 5, 2026
Collaborator
|
This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed. Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Partially addresses #4059 by restricting what characters a named toolchain may contain.
Named toolchains are now validated against the UTS #39 general security profile.
In essence;
unicode_security::GeneralSecurityProfile::identifier_allowed()vs this hand-rolled pattern we had before. Letters and digits in any script stay legal, so合法的still works, as do.,_and-. Whitespace, most punctuation, emoji, and invisible or direction-altering characters are rejected. I also exclude:(NTFS alternate data streams) and'(shell quoting), plus.and.., which the profile allows.This is breaking for unusual names like
foo#baror names with spaces. However it doesn't touch therust-toolchain.tomldiagnostics. Confusables are also still unresolved (i.e.μvsµ, precomposed vs decomposedé).