fix: broaden unit-runtime path sanitization to strip all unsafe characters

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Lex Christopherson 2026-03-18 11:15:33 -06:00
parent 5b36754a19
commit 05bd7089f3

View file

@ -51,8 +51,8 @@ function runtimeDir(basePath: string): string {
}
function runtimePath(basePath: string, unitType: string, unitId: string): string {
const sanitizedUnitType = unitType.replace(/[\/]/g, "-");
const sanitizedUnitId = unitId.replace(/[\/]/g, "-");
const sanitizedUnitType = unitType.replace(/[^a-zA-Z0-9._-]+/g, "-");
const sanitizedUnitId = unitId.replace(/[^a-zA-Z0-9._-]+/g, "-");
return join(runtimeDir(basePath), `${sanitizedUnitType}-${sanitizedUnitId}.json`);
}