From 9d63ab2456340e75e04543b52b712da84da62778 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 15 May 2026 03:55:38 +0900 Subject: [PATCH 1/2] fix: allow Next.js route paths in Strix PR scope --- scripts/ci/strix_quick_gate.sh | 2 +- scripts/ci/test_strix_quick_gate.sh | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/scripts/ci/strix_quick_gate.sh b/scripts/ci/strix_quick_gate.sh index 4121e98a7..ca97eafc4 100644 --- a/scripts/ci/strix_quick_gate.sh +++ b/scripts/ci/strix_quick_gate.sh @@ -177,7 +177,7 @@ if "\\" in relative_path_str: normalized = posixpath.normpath(relative_path_str) if normalized in (".", "") or normalized.startswith("../") or normalized == "..": raise SystemExit(1) -if not re.fullmatch(r"[A-Za-z0-9_./ -]+", normalized): +if not re.fullmatch(r"[A-Za-z0-9_./ \[\]-]+", normalized): raise SystemExit(1) relative_path = Path(normalized) if relative_path.is_absolute(): diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index 6acd375fa..6e987a105 100644 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -2748,6 +2748,12 @@ run_pull_request_target_head_scope_case \ "BASE_CONTENT_WITH_SPACE_SHOULD_NOT_BE_SCANNED" \ "HEAD_CONTENT_WITH_SPACE_SHOULD_BE_SCANNED" +run_pull_request_target_head_scope_case \ + "pull-request-target-nextjs-bracket-route-uses-head-blob" \ + "frontend/src/app/labels/[slug]/page.tsx" \ + "BASE_BRACKET_ROUTE_CONTENT_SHOULD_NOT_BE_SCANNED" \ + "HEAD_BRACKET_ROUTE_CONTENT_SHOULD_BE_SCANNED" + run_pull_request_target_rejects_unsafe_changed_path_case \ "pull-request-target-parent-directory-changed-path-fails-closed" \ "../outside.py" From 613cc58c475b4f15bd06368ff923c5412500d461 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 15 May 2026 04:30:53 +0900 Subject: [PATCH 2/2] fix: harden Strix scan target resolution --- scripts/ci/strix_quick_gate.sh | 4 ++-- scripts/ci/test_strix_quick_gate.sh | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/scripts/ci/strix_quick_gate.sh b/scripts/ci/strix_quick_gate.sh index ca97eafc4..6c2006e36 100644 --- a/scripts/ci/strix_quick_gate.sh +++ b/scripts/ci/strix_quick_gate.sh @@ -506,7 +506,7 @@ target_path = Path(raw_target) if not target_path.is_absolute(): target_path = repo_root / target_path -resolved = target_path.resolve(strict=False) +resolved = target_path.resolve(strict=True) print(resolved) PY })" || { @@ -538,7 +538,7 @@ import sys raw_target = sys.argv[1] target_path = Path(raw_target) -resolved = target_path.resolve(strict=False) +resolved = target_path.resolve(strict=True) print(resolved) PY })" || { diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index 6e987a105..b313aa27d 100644 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -82,6 +82,7 @@ assert_strix_workflow_pr_trigger_hardened() { assert_strix_gate_target_scope_separated() { assert_file_not_contains "$GATE_SCRIPT" "or generated PR scope directories" "strix gate keeps user target validation separate from internal PR scopes" assert_file_contains "$GATE_SCRIPT" "TARGET_PATH_IS_INTERNAL_PR_SCOPE" "strix gate marks internally generated PR scan scopes explicitly" + assert_file_not_contains "$GATE_SCRIPT" "resolved = target_path.resolve(strict=False)" "strix gate must resolve scan targets strictly" } assert_internal_pr_scope_targets() {