Checkpoint — Security Reasoning
beginner8 min readLesson 198 of 204
The sandboxer contract frozen, stricter battery: escapes via segments, names that merely look like traversal, and canonical outputs that must match exactly.
What you must be able to do
Distinguish look-alike from is: ..hidden is a name; .. is traversal; a/../.. escapes. Canonicalization is the only honest referee.