From b1eb2b3c9bad9b39ca8c3a2d87c8b1e1ed3e88ee Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Mon, 18 May 2026 12:44:54 +0200
Subject: [PATCH] fix: correct regex for valid API post path validation

---
 lib/admin/csp-frame-origins.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/admin/csp-frame-origins.ts b/lib/admin/csp-frame-origins.ts
index be1a8197..ebbfe9ad 100644
--- a/lib/admin/csp-frame-origins.ts
+++ b/lib/admin/csp-frame-origins.ts
@@ -73,7 +73,7 @@ export function isValidApiPostPath(path: unknown): path is string {
   if (!path.startsWith('/api/')) return false;
   if (path.includes('..')) return false;
   if (/[\s'"`;,()?#]/.test(path)) return false;
-  if (!/^[/A-Za-z0-9._\-]+$/.test(path)) return false;
+  if (!/^[/A-Za-z0-9._-]+$/.test(path)) return false;
   return true;
 }