Fix unescaped dots in package name validation regex patterns by Copilot · Pull Request #26775 · PowerShell/PowerShell

Copilot · 2026-02-10T17:13:44Z

Regex patterns for package name validation used unescaped dots (.) which match any character, allowing malformed names like powershell-7.6.0-preview@6-osx-x64.pkg to pass validation.

-if($_.Name -notmatch 'powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*.\d+\-)?osx\-(x64|arm64)\.pkg')
+if($_.Name -notmatch 'powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?osx\-(x64|arm64)\.pkg')

Changes

Escaped dots in version suffix patterns ([a-z]*. → [a-z]*\.) across:
- .pipelines/templates/release-validate-packagenames.yml (tar.gz, pkg, msi/zip, deb patterns)
- test/packaging/macos/package-validation.tests.ps1 (pkg pattern)
- test/packaging/linux/package-validation.tests.ps1 (tar.gz pattern)

Now correctly rejects names with wrong delimiters (e.g., preview@6, rebuild-5) while accepting valid suffixes (e.g., preview.6, rebuild.5).

Original prompt

Please address #26435 (comment)

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Copilot

Pull request overview

Tightens package-name validation by fixing regex patterns that previously treated . as “any character”, which could allow malformed package names (e.g., preview@6) to pass validation in release pipelines and packaging tests.

Changes:

Escaped the dot between suffix label and suffix number (e.g., preview.6) in macOS .pkg validation.
Escaped the same dot in Linux .tar.gz validation.
Escaped the same dot across multiple artifact validation patterns in the release pipeline template (tar.gz, pkg, msi/zip, deb).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
`.pipelines/templates/release-validate-packagenames.yml`	Makes package name validation stricter by escaping `.` in suffix patterns across multiple artifact types.
`test/packaging/macos/package-validation.tests.ps1`	Aligns macOS PKG test regex with the corrected dot-escaped suffix format.
`test/packaging/linux/package-validation.tests.ps1`	Aligns Linux tar.gz validation regex with the corrected dot-escaped suffix format.

Copilot · 2026-02-10T17:44:32Z

.pipelines/templates/release-validate-packagenames.yml

      $message = @()
      Get-ChildItem $(System.ArtifactsDirectory)\* -recurse -include *.zip, *.msi | ForEach-Object {
-          if($_.Name -notmatch 'PowerShell-\d+\.\d+\.\d+\-([a-z]*.\d+\-)?win\-(fxdependent|x64|arm64|x86|fxdependentWinDesktop)\.(msi|zip){1}')
+          if($_.Name -notmatch 'PowerShell-\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?win\-(fxdependent|x64|arm64|x86|fxdependentWinDesktop)\.(msi|zip){1}')


The Windows MSI/ZIP name regex uses ([a-z]*\.\d+\-)?, which allows an empty label before the dot (e.g. -.6-). If only named suffixes like preview.6 are valid, change [a-z]* to [a-z]+ (and consider anchoring with ^...$ to avoid substring matches).

Suggested change

if($_.Name -notmatch 'PowerShell-\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?win\-(fxdependent|x64|arm64|x86|fxdependentWinDesktop)\.(msi|zip){1}')

if($_.Name -notmatch '^PowerShell-\d+\.\d+\.\d+\-([a-z]+\.\d+\-)?win\-(fxdependent|x64|arm64|x86|fxdependentWinDesktop)\.(msi|zip){1}$')

Copilot · 2026-02-10T17:44:32Z

.pipelines/templates/release-validate-packagenames.yml

      $message = @()
      Get-ChildItem $(System.ArtifactsDirectory)\* -recurse -filter *.deb | ForEach-Object {
-          if($_.Name -notmatch 'powershell(-preview|-lts)?_\d+\.\d+\.\d+([\-~][a-z]*.\d+)?-\d\.deb_amd64\.deb')
+          if($_.Name -notmatch 'powershell(-preview|-lts)?_\d+\.\d+\.\d+([\-~][a-z]*\.\d+)?-\d\.deb_amd64\.deb')


The DEB validation regex uses ([\-~][a-z]*\.\d+)?, which allows an empty label after -/~ (e.g. -.6). If suffixes must be named (like -preview.6), require at least one letter ([a-z]+). Also consider anchoring the pattern (^...$) so only full-filename matches are accepted.

Suggested change

if($_.Name -notmatch 'powershell(-preview|-lts)?_\d+\.\d+\.\d+([\-~][a-z]*\.\d+)?-\d\.deb_amd64\.deb')

if($_.Name -notmatch '^powershell(-preview|-lts)?_\d+\.\d+\.\d+([\-~][a-z]+\.\d+)?-\d\.deb_amd64\.deb$')

Copilot · 2026-02-10T17:44:32Z

test/packaging/linux/package-validation.tests.ps1

                # Pattern matches: powershell-7.6.0-preview.6-linux-x64.tar.gz or powershell-7.6.0-linux-x64.tar.gz
                # Also matches various runtime configurations
-                if ($package.Name -notmatch 'powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*.\d+\-)?(linux|osx|linux-musl)+\-(x64\-fxdependent|x64|arm32|arm64|x64\-musl-noopt\-fxdependent)\.(tar\.gz)') {
+                if ($package.Name -notmatch 'powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?(linux|osx|linux-musl)+\-(x64\-fxdependent|x64|arm32|arm64|x64\-musl-noopt\-fxdependent)\.(tar\.gz)') {


The tar.gz regex here isn’t anchored and includes (linux|osx|linux-musl)+, which can match invalid names via substring matches and repeated platform tokens (e.g. linuxlinux). Consider switching to an anchored regex (^...$) and removing the + quantifier so only a single platform token is accepted.

Suggested change

if ($package.Name -notmatch 'powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?(linux|osx|linux-musl)+\-(x64\-fxdependent|x64|arm32|arm64|x64\-musl-noopt\-fxdependent)\.(tar\.gz)') {

if ($package.Name -notmatch '^powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?(linux|osx|linux-musl)\-(x64\-fxdependent|x64|arm32|arm64|x64\-musl-noopt\-fxdependent)\.tar\.gz$') {

Copilot · 2026-02-10T17:44:33Z

test/packaging/macos/package-validation.tests.ps1

            # - powershell-7.4.13-rebuild.5-osx-arm64.pkg (Rebuild version)
            # - powershell-lts-7.4.13-osx-arm64.pkg (LTS package)
-            $pkgPackageNamePattern = '^powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*.\d+\-)?osx\-(x64|arm64)\.pkg$'
+            $pkgPackageNamePattern = '^powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?osx\-(x64|arm64)\.pkg$'


([a-z]*\.\d+\-)? allows an empty label before the dot (e.g. -.6-) to match as a “preview/rebuild” suffix. If suffixes must be named (like preview.6/rebuild.5), change [a-z]* to [a-z]+ so malformed names are rejected.

Suggested change

$pkgPackageNamePattern = '^powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?osx\-(x64|arm64)\.pkg$'

$pkgPackageNamePattern = '^powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]+\.\d+\-)?osx\-(x64|arm64)\.pkg$'

Copilot · 2026-02-10T17:44:33Z

.pipelines/templates/release-validate-packagenames.yml

      $message = @()
      Get-ChildItem $(System.ArtifactsDirectory)\* -recurse -filter *.tar.gz | ForEach-Object {
-          if($_.Name -notmatch 'powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*.\d+\-)?(linux|osx|linux-musl)+\-(x64\-fxdependent|x64|arm32|arm64|x64\-musl-noopt\-fxdependent)\.(tar\.gz)')
+          if($_.Name -notmatch 'powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?(linux|osx|linux-musl)+\-(x64\-fxdependent|x64|arm32|arm64|x64\-musl-noopt\-fxdependent)\.(tar\.gz)')


The tar.gz validation regex uses (linux|osx|linux-musl)+, which allows repeated/concatenated platform tokens (e.g. linuxlinux) to pass. Use a single alternation group without the + quantifier (and consider anchoring the pattern to the full filename) so malformed names can’t match via repetition or substring matches.

Suggested change

if($_.Name -notmatch 'powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?(linux|osx|linux-musl)+\-(x64\-fxdependent|x64|arm32|arm64|x64\-musl-noopt\-fxdependent)\.(tar\.gz)')

if($_.Name -notmatch '^powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?(linux|osx|linux-musl)\-(x64\-fxdependent|x64|arm32|arm64|x64\-musl-noopt\-fxdependent)\.tar\.gz$')

Copilot · 2026-02-10T17:44:33Z

.pipelines/templates/release-validate-packagenames.yml

      $message = @()
      Get-ChildItem $(System.ArtifactsDirectory)\* -recurse -filter *.pkg | ForEach-Object {
-          if($_.Name -notmatch 'powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*.\d+\-)?osx\-(x64|arm64)\.pkg')
+          if($_.Name -notmatch 'powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?osx\-(x64|arm64)\.pkg')


This .pkg regex uses ([a-z]*\.\d+\-)?, where [a-z]* permits an empty label (e.g. -.6-) to match as a “suffix”. If the intent is to only allow suffixes like preview.6/rebuild.5, require at least one letter (e.g. [a-z]+) and consider anchoring the pattern (^...$) so extra prefix/suffix text can’t slip through substring matching.

Initial plan

23a3c85

Copilot AI assigned Copilot and TravisEz13 Feb 10, 2026

Copilot started work on behalf of TravisEz13 February 10, 2026 17:14 View session

TravisEz13 mentioned this pull request Feb 10, 2026

[release/v7.4] Update the macos package name for preview releases to match the previous pattern #26435

Merged

8 tasks

Fix unescaped dots in regex patterns for package name validation

b9cad20

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix discussion feedback from pull request review~~ Fix unescaped dots in package name validation regex patterns Feb 10, 2026

Copilot AI requested a review from TravisEz13 February 10, 2026 17:19

Copilot finished work on behalf of TravisEz13 February 10, 2026 17:19

TravisEz13 approved these changes Feb 10, 2026

View reviewed changes

TravisEz13 added CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log BackPort-7.4.x-Consider BackPort-7.5.x-Consider BackPort-7.6.x-Consider labels Feb 10, 2026

TravisEz13 marked this pull request as ready for review February 10, 2026 17:40

TravisEz13 requested review from a team and jshigetomi as code owners February 10, 2026 17:40

Copilot AI review requested due to automatic review settings February 10, 2026 17:40

TravisEz13 enabled auto-merge (squash) February 10, 2026 17:40

Copilot started reviewing on behalf of TravisEz13 February 10, 2026 17:41 View session

Copilot AI reviewed Feb 10, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix unescaped dots in package name validation regex patterns#26775

Fix unescaped dots in package name validation regex patterns#26775
Copilot wants to merge 2 commits intomasterfrom
copilot/address-inline-comment-feedback

Copilot AI commented Feb 10, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	if($_.Name -notmatch 'PowerShell-\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?win\-(fxdependent\|x64\|arm64\|x86\|fxdependentWinDesktop)\.(msi\|zip){1}')
	if($_.Name -notmatch '^PowerShell-\d+\.\d+\.\d+\-([a-z]+\.\d+\-)?win\-(fxdependent\|x64\|arm64\|x86\|fxdependentWinDesktop)\.(msi\|zip){1}$')

	if($_.Name -notmatch 'powershell(-preview\|-lts)?_\d+\.\d+\.\d+([\-~][a-z]*\.\d+)?-\d\.deb_amd64\.deb')
	if($_.Name -notmatch '^powershell(-preview\|-lts)?_\d+\.\d+\.\d+([\-~][a-z]+\.\d+)?-\d\.deb_amd64\.deb$')

	if ($package.Name -notmatch 'powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?(linux\|osx\|linux-musl)+\-(x64\-fxdependent\|x64\|arm32\|arm64\|x64\-musl-noopt\-fxdependent)\.(tar\.gz)') {
	if ($package.Name -notmatch '^powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?(linux\|osx\|linux-musl)\-(x64\-fxdependent\|x64\|arm32\|arm64\|x64\-musl-noopt\-fxdependent)\.tar\.gz$') {

	$pkgPackageNamePattern = '^powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?osx\-(x64\|arm64)\.pkg$'
	$pkgPackageNamePattern = '^powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]+\.\d+\-)?osx\-(x64\|arm64)\.pkg$'

	if($_.Name -notmatch 'powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?(linux\|osx\|linux-musl)+\-(x64\-fxdependent\|x64\|arm32\|arm64\|x64\-musl-noopt\-fxdependent)\.(tar\.gz)')
	if($_.Name -notmatch '^powershell-(lts-)?\d+\.\d+\.\d+\-([a-z]*\.\d+\-)?(linux\|osx\|linux-musl)\-(x64\-fxdependent\|x64\|arm32\|arm64\|x64\-musl-noopt\-fxdependent)\.tar\.gz$')

Conversation

Copilot AI commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Feb 10, 2026 •

edited

Loading