mirror of
https://github.com/storytold/craft-libs.git
synced 2026-11-12 21:42:13 +00:00
smittie2000andClaude Opus 5.5
f3706afe32
craft-update was extracted from ArtCraft Launcher (#311) with the launcher's release.rs as it was, so it has the hole craft-launcher#764 reports: github.com resolves `..` and `%2e%2e` segments before routing, and `download_url_under` only rejected literal `..` and `%2f`/`%5c`. This ports storytold/craft-launcher#921: - release::expected_download_url(repo, tag, name): `<prefix><tag>/<name>`, tag and name limited to ASCII letters, digits and `._+-`. release_from_value keeps an asset only when its link equals it, which also ties the link to its own release. - contains_encoded_separator rejects `%2e` too, and valid_file_name rejects percent-encoded separators and dots, so release_from_sums can't build a link from `%2e%2e%2fother`. - install::check_download_link, called just before the download in install_at and in self_update::update. The self-update path doesn't go through install_at, so without the second call every app's self-update would skip the check. - truncate uses floor_char_boundary; bind_artifact_version uses split_once. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>