When using cheat to create, edit, or remove cheatsheets (e.g., via cheat --edit <name> or cheat --rm <name>), the tool enforces specific naming rules to prevent directory traversal and accidental file overwrites.
Rejected Patterns
The following patterns are not allowed and will result in an error:
- Directory traversal: Names containing
.. (e.g., ../../etc/passwd). - Absolute paths: Names starting with
/ on Unix (e.g., /etc/passwd). - Home directory expansion: Names starting with
~ (e.g., ~/.ssh/config). - Hidden files: Names where the filename starts with
. (e.g., .secret). - Empty names: Providing no name.
Allowed Patterns
The following patterns are valid:
- Simple names:
docker, git. - Nested paths:
docker/compose, lang/go/slice. - Current directory references:
./mysheet (Note: while ./ is allowed, the name itself cannot be just . or start with ..).
# These are allowed:
cheat --edit "docker"
cheat --edit "docker/compose"
cheat --edit "./local"
# These are blocked:
cheat --edit "../../../etc/passwd"
cheat --edit "/etc/passwd"
cheat --edit "~/.ssh/config"
cheat --rm ".."