What's wrong with this entry?
What: Enhanced security check now detects paths with 3+ consecutive dots (e.g., ..., ....) as suspicious Windows path patterns.
Why this matters: Attackers sometimes use unusual dot sequences to bypass basic .. filters. While ... isn't standard, blocking it prevents potential exploits in path normalization edge cases.
Details:
- Adds regex check
/\.{3,}/to Windows path validation - Blocks paths like
C:\Users\....\file.txtorpath/to/.../folder - Triggers manual approval prompt: "contains a suspicious Windows path pattern"
- Complements existing checks for reserved names, alternate data streams, and other Windows-specific attacks
- Evidence: Modified function
tf2() at line 465855(renamed frommf2()); new check at line 465867
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.