Limit RC10 manifest traversal

2026-07-18 07:20:36 +02:00
parent bb38d8a6a3
commit 6983ea19f1
2 changed files with 17 additions and 1 deletions
@@ -170,7 +170,11 @@ def expand_manifest_references(references: set[Path], storage_root: Path) -> set
    root = storage_root.resolve()
    expanded = set(references)
    for manifest in list(references):
-        if manifest.suffix.lower() != ".json" or not manifest.is_file():
+        if (
+            manifest.suffix.lower() != ".json"
+            or "manifest" not in manifest.name.lower()
+            or not manifest.is_file()
+        ):
            continue
        try:
            if manifest.stat().st_size > 16 * 1024 * 1024: