mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-13 08:05:19 +09:00
The proxy derives its single SubjectAccessReview from the request path, so the path has to be split and validated before anything else runs. Names are DNS-1123 checked because they end up quoted inside LogsQL and PromQL scopes, and percent-encoding is refused so a decoded slash cannot shift the segments authorization is built from. Assisted-by: LLM Signed-off-by: ZverGuy <maximbel2003@gmail.com>