Émile Ré f0fe70fe1c Restore url.PathEscape on user-supplied path segments in url.JoinPath calls ...

url.JoinPath does not percent-encode slashes or reserved characters in
its arguments, so user-supplied values (group IDs, slugs, team IDs) must
be wrapped with url.PathEscape to prevent path traversal. Update cursor
rule and contrib guide to codify this as a mandatory practice.

Signed-off-by: Émile Ré <emile@probo.com>

2026-05-20 12:57:26 +04:00

..

release

Add proboctl release track

2026-05-18 19:05:09 +04:00

agent.md

Extract agent and tools from tracker mapping worker into dedicated files

2026-05-19 12:06:15 +04:00

api-surface.md

Update agent rules

2026-04-19 11:49:55 +02:00

app-arborescence.md

Rename vendors to third parties

2026-05-13 21:21:39 +02:00

authorization.md

Rename vendors to third parties

2026-05-13 21:21:39 +02:00

cli.md

Clean agent rules

2026-04-19 11:42:50 +02:00

commit.md

Rename vendors to third parties

2026-05-13 21:21:39 +02:00

config.md

Move dev env file to repo root

2026-04-21 18:51:34 +02:00

coredata.md

Refine PgError constraint checks and document PK rule

2026-05-20 10:14:45 +04:00

e2e.md

Rename vendors to third parties

2026-05-13 21:21:39 +02:00

file-naming.md

Extract agent and tools from tracker mapping worker into dedicated files

2026-05-19 12:06:15 +04:00

gid.md

Clean agent rules

2026-04-19 11:42:50 +02:00

go-service.md

Move Go service orchestration to contrib/claude

2026-03-15 15:04:33 +01:00

go-style.md

Restore url.PathEscape on user-supplied path segments in url.JoinPath calls

2026-05-20 12:57:26 +04:00

go-testing.md

Clean agent rules

2026-04-19 11:42:50 +02:00

go-worker.md

Migrate workers to kit/worker

2026-04-13 12:25:42 +02:00

graphql.md

Rename vendors to third parties

2026-05-13 21:21:39 +02:00

httpclient.md

Mitiate SSRF attack

2026-04-20 12:11:17 +02:00

license.md

Extend license header to all source file types

2026-03-15 15:04:32 +01:00

logging.md

Add logging and encryption rules

2026-04-19 11:59:22 +02:00

make.md

Review fixes

2026-04-29 12:48:44 +04:00

mcp.md

Rename vendors to third parties

2026-05-13 21:21:39 +02:00

n8n.md

Clean agent rules

2026-04-19 11:42:50 +02:00

react-components.md

Rename vendors to third parties

2026-05-13 21:21:39 +02:00

relay.md

Rename vendors to third parties

2026-05-13 21:21:39 +02:00

sandbox.md

Use make sandbox-* targets in sandbox doc

2026-04-29 12:48:44 +04:00

ts-style.md

Add safe URL construction rules to agent guides

2026-04-24 16:12:27 +02:00

ui.md

ui: stop importing phosphor icons with bare-name aliases

2026-05-11 14:56:34 +04:00

validation.md

Rename vendors to third parties

2026-05-13 21:21:39 +02:00