CarloandIan Littman c86ad041b2 Scope package identifier validation to template substitution (#41028) ...

Fixes #41009

## Summary

- Scope `ValidatePackageIdentifiers` to only run when `$PACKAGE_ID` or
`$UPGRADE_CODE` template variables are present in the uninstall script
  - Move `dmg`/`zip` early return before validation
- Switch from ASCII allowlist to shell metacharacter denylist, allowing
legitimate non-ASCII product names (e.g., `®`, parens) while still
blocking injection characters

  ## Test plan

- [x] Added unit tests for conditional validation (non-ASCII IDs
with/without template vars, dmg/zip bypass, upgrade code scoping)
  - [x] Existing input tests still pass
  - [x] Winget ingester tests unaffected

---------

Co-authored-by: Ian Littman <iansltx@gmail.com>

2026-03-05 13:37:57 -05:00

..

scripts

…

testdata

…

deb.go

…

file_bench_test.go

…

file_test.go

…

file.go

…

ipa.go

…

management_test.go

Scope package identifier validation to template substitution (#41028)

2026-03-05 13:37:57 -05:00

management.go

Scope package identifier validation to template substitution (#41028)

2026-03-05 13:37:57 -05:00

msi.go

…

pdf_test.go

…

pdf.go

…

pe_test.go

…

pe.go

…

rpm_test.go

…

rpm.go

…

tgz.go

…

validation_test.go

…

validation.go

…

xar_test.go

Bugfix: ignore nested .app files in .pkg metadata extraction (#40851)

2026-03-03 12:33:31 -05:00

xar.go

Bugfix: ignore nested .app files in .pkg metadata extraction (#40851)

2026-03-03 12:33:31 -05:00