Purpose of safe_local_report_path?

[kiwiz]

Relevant XKCD:

Hi there, I'm curious about what the path.include?("/.") check in safe_local_report_path is for. The reason I ask is because I'm currently populating the output into a JSON file located at REPO_PATH/.salus/salus.json, which triggers this condition.

Could the pattern be updated to "/..", which is less likely to be valid (I can submit a PR if so)?

[ghbren]

Hi, a . in the file name along with other things could be used for security exploits.

Would it be possible for you to just update
REPO_PATH/.salus/salus.json to
REPO_PATH/salus/salus.json?

[joshuaostrom-cb]

I think we would be open to mediating that check. We recently added a plugin support to Salus and mediating that check [so you can override as needed] may be an acceptable solution. Will check internally to confirm that and relay.