Enforce tar entry path normalization in pub_package_reader - #9579
Merged
Merged
Conversation
Reject non-normalized paths, redundant slashes, relative references (`.`, `./`, `..`), and duplicate normalized entries in scanned package archives to ensure the archive entries evaluated during validation match what downstream clients extract.
isoos
approved these changes
Sep 15, 2026
sigurdm
added a commit
that referenced
this pull request
Sep 15, 2026
Reject non-normalized paths, redundant slashes, relative references (`.`, `./`, `..`), and duplicate normalized entries in scanned package archives to ensure the archive entries evaluated during validation match what downstream clients extract.
sigurdm
added a commit
that referenced
this pull request
Sep 15, 2026
* feat: Redirect production downloads directly to primary host (#9572) This simplifies the architecture. Instead of rewriting or signing the GCS canonical buckets, this simply relies on Google Cloud Load Balancer logic. If the user hits the service directly via AppEngine, we redirect them to the canonical domain, which natively routes via GCLB and serves the cached bucket. * Enforce tar entry path normalization in pub_package_reader (#9579) Reject non-normalized paths, redundant slashes, relative references (`.`, `./`, `..`), and duplicate normalized entries in scanned package archives to ensure the archive entries evaluated during validation match what downstream clients extract. * Cleanup dartdoc image marker handling and HTML sanitization (#9578) * Cleanup dartdoc image marker handling and HTML sanitization - Retain image marker prefix through sanitization instead of stripping it via string replacement, and resolve it during rendering. - Escape substituted URLs in attribute context. - Drop HTML comments during sanitization. * Bump runtimeVersion to 2026.09.14 * Match the exact encodeComponent alphabet in the image marker pattern * Update end2end task test goldens
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tar archives uploaded to pub.dev can contain non-normalized entry names (e.g.
./pubspec.yaml,foo/../pubspec.yaml, redundant slashes, or whitespace padding) or duplicate entries that normalize to the same path. Because pub.dev normalizes entry names during archive summarization while downstream extractors may operate on raw entry names, differences in path interpretation could cause mismatches between validated files and extracted files.This change:
./, directory navigation (..), and whitespace padding.