When saving from tstyles tune, "Save as a new name" validates the name with
^[A-Za-z0-9._-]+$ (tstyles.ps1, ~line 2726). Both . and .. satisfy that
pattern:
'..' -match '^[A-Za-z0-9._-]+$' # True
'.' -match '^[A-Za-z0-9._-]+$' # True
The name is then used as a directory segment under the user styles dir, so ..
resolves to the parent — the data root itself.
Expected
Reject a name that does not resolve to a new directory inside the styles dir.
Notes
Not a security hole: the parent is the module's own data root, and the files
written are an ordinary style's (scheme.json, theme.json, profile.ps1,
prompt.sh, tune.json). But it produces a nonsense entry and should not be
accepted.
The interesting design question — worth deciding in the PR — is whether to
special-case dot-only names or to check that the resolved path is genuinely
under the styles dir. The second is more robust and not much more code.
Why this is a good first issue
Small, self-contained, and the validator already exists — it just needs one more
condition plus a test.
When saving from
tstyles tune, "Save as a new name" validates the name with^[A-Za-z0-9._-]+$(tstyles.ps1, ~line 2726). Both.and..satisfy thatpattern:
The name is then used as a directory segment under the user styles dir, so
..resolves to the parent — the data root itself.
Expected
Reject a name that does not resolve to a new directory inside the styles dir.
Notes
Not a security hole: the parent is the module's own data root, and the files
written are an ordinary style's (
scheme.json,theme.json,profile.ps1,prompt.sh,tune.json). But it produces a nonsense entry and should not beaccepted.
The interesting design question — worth deciding in the PR — is whether to
special-case dot-only names or to check that the resolved path is genuinely
under the styles dir. The second is more robust and not much more code.
Why this is a good first issue
Small, self-contained, and the validator already exists — it just needs one more
condition plus a test.