fix(.life): binding ui_hints _ref fields path-traversal pattern (post-#111 review)#114
Merged
LING71671 merged 1 commit intoApr 26, 2026
Conversation
…111 review) Sibling fix to #111's providers_whitelist_ref tightening. surface.ui_hints .avatar_image_ref and .background_audio_ref are also paths inside the `.life` zip and were missing the cross-schema path-traversal pattern `^(?!/)(?!.*\.\.).+$` applied elsewhere (life-package contents[].path, lifecycle.mutation_log_ref, binding.providers_whitelist_ref). Tests: 8 new cases (6 negative + 2 happy) — absolute path, parent-dir traversal, embedded `..` segment, and a normal relative path for each of the two fields. Total 55 → 63 (11 happy-path + 52 negative). Local validation: tools/test_binding_schema.py reports `run: 63 cases, failures: 0`; tools/batch_validate.py 21/21 green. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Contributor
Author
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
devin-ai-integration Bot
added a commit
that referenced
this pull request
Apr 26, 2026
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This was referenced Apr 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sibling fix to the path-traversal tightening on
providers_whitelist_refthat landed inside #111. A new Devin Review finding on the merged
PR pointed out that
surface.ui_hints.avatar_image_refandsurface.ui_hints.background_audio_refare also paths-inside-.lifeand were left with
minLength: 1only — same defence-in-depth gap asproviders_whitelist_refhad before #111.This PR applies the same
^(?!/)(?!.*\\.\\.).+$pattern (cross-schemaconvention shared with
life-package.schema.json::contents[].path,lifecycle.schema.json::mutation_log_ref, and the now-fixedbinding.schema.json::providers_whitelist_ref).Changes
schemas/binding.schema.json: addpatterntoavatar_image_refandbackground_audio_refundersurface.ui_hints(additionalProperties: falseblock).tools/test_binding_schema.py: 8 new cases (6 negative + 2 happy)per field — absolute path (
/etc/passwd), parent-dir traversal(
../etc/passwd), embedded..segment (media/../etc/passwd), andone normal relative path (
media/avatar.png). Total goes from 55 → 63(11 happy-path + 52 negative).
CHANGELOG.md: bump the v0.8 binding sanity-test count and explainthe bump source.
Local validation
python tools/test_binding_schema.py→run: 63 cases, failures: 0python tools/batch_validate.py→ 21/21 steps passReview & Testing Checklist for Human
Risk: green — 2-line schema tightening + 8 new sanity tests, no
behavioural change for any compliant binding (existing example bindings
already use bare relative paths).
^(?!/)(?!.*\\.\\.).+$matches whatlife-package.schema.json::contents[].pathandlifecycle.schema.json::mutation_log_refuse.example currently using
ui_hintslives inside test fixtures anduses
disclosure_labelonly).Notes
on the merged v0.8: docs/LIFE_BINDING_SPEC.md + schemas/binding.schema.json + sanity tests (#103) #111.
Link to Devin session: https://app.devin.ai/sessions/ff7322e18fd94887875daa2c1c75f87d
Requested by: @LING71671