fix: close input normalization aliases

2026-09-02 00:44:38 +03:00
parent 0a34f90bb9
commit 6428b5dcd6
4 changed files with 26 additions and 3 deletions
--- a/src/content/asset-url.ts
+++ b/src/content/asset-url.ts
@@ -6,7 +6,7 @@ const normalizeAssetBase = (base: string): string => {
  if (
    !base.startsWith('/') ||
    base.startsWith('//') ||
-    /[\\%?#]/u.test(base) ||
+    /[\u0000-\u001f\u007f\\%?#]/u.test(base) ||
    base.split('/').some((segment) => segment === '.' || segment === '..')
  ) {
    throw new Error('Asset URL base must be a safe absolute path.');