Bridgelink development fix 01

[jlodew0]

No description provided.

[jlodew0]

ok

[Innovarzweng]

@jlodew0 Thanks for submitting this PR.
Would you please provide the description of this PR so that Innovar team can review?

Thanks,
Jim

[jlodew0]

@jlodew0 Thanks for submitting this PR. Would you please provide the description of this PR so that Innovar team can review?

Thanks, Jim

Hi Jim,

Thanks for the message. It’s been quite a while since I last looked at this, so I had to refresh my memory a bit 🙂

PR #92 came out of a moment where I was looking into the GitHub code scanning alerts that were reported back then. The two main things I tried to address were:

• A potential path traversal issue around how rootFolder and baseFolder are handled.
• The scanner complaining about possible injection risks in filePattern.

The intent wasn’t to redesign functionality, but more to put in some guardrails to quiet those findings. In hindsight, I agree that especially the filePattern change is probably too strict and could break existing configurations that rely on dynamic filenames. Same story for the strict “subdirectory only” check — that’s arguably more of a policy choice than a hard requirement.

So yeah, happy to admit this was more of a defensive/security-driven change than a fully thought-through functional one. If BridgeLink still needs something in this area, I’m happy to explain what I was aiming for or adjust the approach.

Kind regards,

Jo