From 50be8bb35ae3e9ca0ee718cba6f6f3d941dbbcdc Mon Sep 17 00:00:00 2001 From: Paul Bakaus Date: Mon, 7 Sep 2026 13:35:41 -0700 Subject: [PATCH] Fix Windows CSP candidate path normalization Normalize native relative paths before slash-based CSP classification and signal output. Preserve literal Unix backslashes. AI assistance: Codex, under maintainer direction. --- crates/context/src/detect_csp.rs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/crates/context/src/detect_csp.rs b/crates/context/src/detect_csp.rs index db3f33829..0319ea4a0 100644 --- a/crates/context/src/detect_csp.rs +++ b/crates/context/src/detect_csp.rs @@ -167,7 +167,11 @@ fn walk(root: &str, dir: &str, depth: usize, hits: &mut Hits) { let Ok(bytes) = std::fs::read(&abs) else { continue }; let slice = if bytes.len() > MAX_READ_BYTES { &bytes[..MAX_READ_BYTES] } else { &bytes[..] }; let body = String::from_utf8_lossy(slice); - visit(root, &abs, &jsp::relative("/", root, &abs), &body, hits); + // Candidate patterns use '/', while native Windows relative paths + // use '\\'. Normalize once for classification and portable signals; + // to_posix preserves literal backslashes in Unix filenames. + let rel = jsp::to_posix(&jsp::relative("/", root, &abs)); + visit(root, &abs, &rel, &body, hits); } }