feat(npm): S11 dist-tag & file-name validation (Step 7c)

Dzmitry (Dima) Meshcharakourequested to merge
dm/npm-local-step-7c-tag-file into main

What

Split 3/3 of !427 (closed) (S11 Step 7 validation helpers). Pure dist-tag-name and tarball-file-name validators. Stacked on Step 7b (!434 (merged)) — they reuse the version parser's isNumeric / ValidateVersion.

  • ValidateTagName — 1-255 bytes; rejects NUL/control bytes and any name npm's semver.validRange would accept (exact/partial versions, x-ranges, comparator and compound ranges).
  • ValidateFileName — {plain_name}-{version}.tgz shape; the name must be a single clean path component (path.Base, not ./../\//) so it cannot traverse directories yet still accepts legit names like my..pkg.
  • FuzzValidateFileName / FuzzValidateTagName — no-panic + accepted-output invariants; the fuzz:npm job (added in 7b) now runs all three targets.

Spec / acceptance

Covers AC 23 (tag_name_invalid) and the AC 53 path-traversal unit foundation (integration half lands in Step 9).

Notes

  • Stacking: targets dm/npm-local-step-7b-version; the tip of the stack. Once 7a and 7b merge, this reproduces !427 (closed)'s delivered code.

Merge request reports