0a0bfdda

Reject unsafe relative media paths (#285)

Reject absolute paths and parent-directory escapes in RelativePath values so media lookups stay within the expected backend-relative root.

Reviewed-on: https://codeberg.org/mtlynch/little-moments/pulls/285

Agent Instructions

Each run corresponds to one flake attribute. Click a run for its logs and status.

Example: https://nix-ci.com/cb:mtlynch:little-moments/master/0a0bfdda84a7504248b09155922626f6f2a04e0c/3b253a9a-5e00-4a1c-bf94-60d2dcd34f9f

Wait for suite to complete:

curl --netrc -N https://nix-ci.com/cb:mtlynch:little-moments/master/0a0bfdda84a7504248b09155922626f6f2a04e0c/wait

This page is also available in machine-friendly formats. Request one with the Accept header:

• curl --netrc -H 'Accept: application/json' https://nix-ci.com/cb:mtlynch:little-moments/master/0a0bfdda84a7504248b09155922626f6f2a04e0c
• curl --netrc -H 'Accept: text/markdown' https://nix-ci.com/cb:mtlynch:little-moments/master/0a0bfdda84a7504248b09155922626f6f2a04e0c

For more instructions, fetch https://nix-ci.com/instructions .