Émile Ré f0fe70fe1c Restore url.PathEscape on user-supplied path segments in url.JoinPath calls ...

url.JoinPath does not percent-encode slashes or reserved characters in
its arguments, so user-supplied values (group IDs, slugs, team IDs) must
be wrapped with url.PathEscape to prevent path traversal. Update cursor
rule and contrib guide to codify this as a mandatory practice.

Signed-off-by: Émile Ré <emile@probo.com>

2026-05-20 12:57:26 +04:00

..

config-propagation.mdc

Version Cursor rules

2026-05-19 14:10:39 +04:00

go-coredata-load-naming.mdc

Version Cursor rules

2026-05-19 14:10:39 +04:00

go-declarations.mdc

Version Cursor rules

2026-05-19 14:10:39 +04:00

go-delete-no-rows-check.mdc

Version Cursor rules

2026-05-19 14:10:39 +04:00

go-error-handling.mdc

Version Cursor rules

2026-05-19 14:10:39 +04:00

go-imports.mdc

Version Cursor rules

2026-05-19 14:10:39 +04:00

go-logging.mdc

Version Cursor rules

2026-05-19 14:10:39 +04:00

go-multiline-params.mdc

Version Cursor rules

2026-05-19 14:10:39 +04:00

go-naming-conventions.mdc

Version Cursor rules

2026-05-19 14:10:39 +04:00

go-pg-constraint-check.mdc

Refine PgError constraint checks and document PK rule

2026-05-20 10:14:45 +04:00

go-upsert-returning-id.mdc

Version Cursor rules

2026-05-19 14:10:39 +04:00

go-url-construction.mdc

Restore url.PathEscape on user-supplied path segments in url.JoinPath calls

2026-05-20 12:57:26 +04:00

no-outlet-context-data.mdc

Version Cursor rules

2026-05-19 14:10:39 +04:00

relay-fragments-not-data-props.mdc

Version Cursor rules

2026-05-19 14:10:39 +04:00

template-files.mdc

Version Cursor rules

2026-05-19 14:10:39 +04:00