What
Expansion safety analysis now catches allowlist patterns whose expanded path would be silently rewritten by URL parsing.
Details
- A pattern containing
$whose expanded path carries a..or.segment is treated as unsafe. - The diagnostic explains how to fix it and distinguishes patterns where the
$is not a real ${NAME} reference. - The variable list in the diagnostic now includes missing variables, and the analysis result exposes missingVars to callers.
- Allowlist entries using an unsafe expansion continue to fail closed.
Evidence
the expanded entry's path carries a dot segment ('..' or '.') that URL parsing would collapse
Strings lifted out of the shipped bundle, so the claim above can be checked against them.