fix(toolchain)!: restrict named toolchain characters - #4932
Merged
Conversation
Contributor
Author
|
Note to myself that this will probably need some corrections once #4930 is merged |
cachebag
force-pushed
the
main
branch
4 times, most recently
from
June 30, 2026 14:11
1318f92 to
9118fcc
Compare
djc
reviewed
Jun 30, 2026
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Member
|
@cachebag Thanks for this PR! I think given your comment in #4932 (comment) I'll probably review #4930 first and come back to this one later, many thanks for your understanding 🙏 |
djc
reviewed
Jun 30, 2026
cachebag
force-pushed
the
main
branch
7 times, most recently
from
June 30, 2026 21:07
86f5e64 to
b8c8bb9
Compare
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
cachebag
force-pushed
the
main
branch
4 times, most recently
from
June 30, 2026 23:07
913f977 to
a8ed506
Compare
rami3l
reviewed
Jul 1, 2026
cachebag
force-pushed
the
main
branch
4 times, most recently
from
July 14, 2026 20:23
39f608c to
dca40d2
Compare
cachebag
force-pushed
the
main
branch
2 times, most recently
from
July 20, 2026 00:46
d14a77d to
4259f6e
Compare
This comment has been minimized.
This comment has been minimized.
cachebag
force-pushed
the
main
branch
3 times, most recently
from
August 3, 2026 14:24
417f74c to
028f723
Compare
cachebag
marked this pull request as ready for review
August 3, 2026 14:40
rami3l
reviewed
Aug 5, 2026
Collaborator
|
This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed. Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers. |
rami3l
reviewed
Aug 5, 2026
rami3l
approved these changes
Aug 5, 2026
Member
There was a problem hiding this comment.
LGTM, thanks a whole lot for the work!
I'll ask @ChrisDenton for one additional round just to make sure that this new pattern looks good to everyone :)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Partially addresses #4059 by restricting what characters a named toolchain may contain.
Named toolchains are now validated against the UTS #39 general security profile.
In essence;
unicode_security::GeneralSecurityProfile::identifier_allowed()vs this hand-rolled pattern we had before. Letters and digits in any script stay legal, so合法的still works, as do.,_and-. Whitespace, most punctuation, emoji, and invisible or direction-altering characters are rejected. I also exclude:(NTFS alternate data streams) and'(shell quoting), plus.and.., which the profile allows.This is breaking for unusual names like
foo#baror names with spaces. However it doesn't touch therust-toolchain.tomldiagnostics. Confusables are also still unresolved (i.e.μvsµ, precomposed vs decomposedé).