Module guard 

Request-path guards: the percent-encoding refusal and the owner / repo / ref / path validators the JSON API and the HTML lanes share.

Cites the JSS forge dispatcher (the %2e|%2f|%5c|%00 refusal ahead of routing) and helpers.js (okSegment, okPath, okRef) by name only.

Constants

RESERVED_OWNERS

First path segments the router gives a meaning of its own. An owner with one of these names would be routed one way and gated another (for example /api/<name>.git/info/refs is smart-HTTP git but looks like the API namespace to a path-segment check), so they can never be owner names.

Functions

is_sha

JSS SHA_RE: ^[0-9a-f]{4,64}$.

ok_owner

JSS OWNER_NAME: ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$, no ...

ok_path

Segment-wise ok_segment over a path split.

ok_ref

JSS okRef: ^[A-Za-z0-9][A-Za-z0-9._/-]{0,200}$ without .., a trailing / or //.

ok_repo

JSS REPO_NAME: ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$, no .., no .git suffix.

ok_segment

JSS okSegment: a non-empty path segment of at most 255 bytes that does not start with ., contain .., a backslash, a control character or a percent-form of . / \.

percent_guard

Refuse a request path that still carries a percent-form of ., /, \ or NUL, or a literal NUL, backslash or control character.

reserved_owner

true when s is a RESERVED_OWNERS word (ASCII case-insensitive).