fix: anchored input patterns end at the last character (/D)

Without /D, "$" also matches before a trailing "\n", so "custom_meta_telefon\n",
a color setting "5\n" (stored as sent) or a whole reference followed by "\n"
passed VariableRef. Added /D to every ^...$ pattern that validates client or
admin input:
- VariableRef META_KEY, NUMBER, WHOLE (canonical/typeOf; Placeholders::field
  shares META_KEY)
- Cursor::decode, GuideRepository topic names (MCP input and filter keys)
- ExposurePolicy::sanitize ability keys and group ids, LogTab list filters

Not changed: Placeholders::PATTERN (runs on trim()), Warnings hex checks (hints
only), NodeSummary/AttrPathIndex/LogListTable (stored or Divi data, no client
input). Each fixed pattern has a test with a trailing "\n" that is rejected.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
2026-09-26 18:02:51 +02:00
co-authored by Claude Opus 5.5
parent 60290c85a5
commit e420145cbe
10 changed files with 81 additions and 9 deletions
+1 -1
View File
@@ -13,7 +13,7 @@ namespace LIT\MCP\Guides;
*/
final class GuideRepository
{
private const TOPIC_PATTERN = '/^[a-z0-9]+(?:-[a-z0-9]+)*$/';
private const TOPIC_PATTERN = '/^[a-z0-9]+(?:-[a-z0-9]+)*$/D';
/** @var array<string, string>|null Filtered topics, read once per instance (= request). */
private ?array $filtered = null;