From 40ccda1b4acedb66536303db87d6178c98981b38 Mon Sep 17 00:00:00 2001
From: RinZ27 <222222878+RinZ27@users.noreply.github.com>
Date: Fri, 8 May 2026 21:45:31 +0700
Subject: [PATCH] fix(server): expand Windows reserved name check to include
 extensions

- Updated sanitizeRepoName to block Windows reserved names (CON, NUL, etc.) even when they have extensions (e.g., CON.txt).
- Corrected regex and added unit tests for these edge cases to resolve CI failures on Windows.
- Ref: https://github.com/abhigyanpatwari/GitNexus/pull/1305#issuecomment-4407200914
---
 gitnexus/src/storage/git.ts    | 2 +-
 gitnexus/test/unit/git.test.ts | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/gitnexus/src/storage/git.ts b/gitnexus/src/storage/git.ts
index 9dafa0aee..75e6e91d3 100644
--- a/gitnexus/src/storage/git.ts
+++ b/gitnexus/src/storage/git.ts
@@ -273,7 +273,7 @@ export const sanitizeRepoName = (name: string): string => {
   // 3. Block path traversal segments and Windows reserved names.
   // Windows reserved names like CON, PRN, AUX, NUL, COM1-9, LPT1-9 cannot
   // be used as directory names on Windows even if they have an extension.
-  const reserved = /^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])$/i;
+  const reserved = /^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(\..*)?$/i;
   if (!sanitized || sanitized === '.' || sanitized === '..' || reserved.test(sanitized)) {
     return 'unknown';
   }
diff --git a/gitnexus/test/unit/git.test.ts b/gitnexus/test/unit/git.test.ts
index 41f66bc61..1bebf4143 100644
--- a/gitnexus/test/unit/git.test.ts
+++ b/gitnexus/test/unit/git.test.ts
@@ -190,6 +190,11 @@ describe('git utilities', () => {
       expect(sanitizeRepoName('NUL')).toBe('unknown');
       expect(sanitizeRepoName('COM1')).toBe('unknown');
       expect(sanitizeRepoName('LPT9')).toBe('unknown');
+
+      // Reserved names with extensions
+      expect(sanitizeRepoName('CON.txt')).toBe('unknown');
+      expect(sanitizeRepoName('NUL.tar.gz')).toBe('unknown');
+      expect(sanitizeRepoName('AUX.local')).toBe('unknown');
     });
 
     it('returns unknown for empty or invalid input', () => {