// interactive · path allowlist
The wildcard that spans a slash
An allowlist for /files/* means one file, directly under
/files/. Written as a shell glob, * also matches
across /, so /files/../../etc/passwd reads as a
match. Type a path below. A naive fnmatch glob and an anchored
regex each rule on it, and often the path one approves the other refuses.
// 01 · rule on a path
>
in policy
out of policy
// 02 · two matchers, one verdict each
fnmatch(path, "/files/*")
# glob compiled to a full-match regex ^/files/.*$
—
re.fullmatch(r"^/files/[^/]+$", path)
# one segment, anchored on both ends ^/files/[^/]+$
—