fix(core): anchor the dynamic report name with \z, not $

In .NET, $ matches at the end of input AND immediately before a trailing
newline, so ^[a-zA-Z][a-zA-Z0-9_-]{0,99}$ accepted a name ending in one.
That name is remotely creatable through POST /api/reports, and this
validator is the only thing standing in front of it.

The concrete consequence is the log statements in ReportJobWorker and
InMemoryJobScheduler: in a plain-text sink the trailing newline splits
the line and lets the name forge a log entry of its own, which is what
CodeQL cs/log-forging was pointing at. Path traversal was never reachable
through it — /, \, . and : have never been in the character class — so
this is the validator not doing what its own doc comment claims rather
than a hole in the file layout. \z means end of input and nothing else.

The type had NO tests at all, which is how an under-anchored pattern
survived since it was written; it has sixteen now, including the trailing
newline, embedded control characters, the length boundary and the
path-traversal shapes the type exists to reject.

One existing assertion had to change with it: ScheduleEndpointTests
compared DynamicReportName.Pattern against the RAW response body, and the
pattern now contains a backslash, which JSON doubles on the wire. It
reads the parsed `error` field instead — stricter, since it also pins
which field carries the message.

Recorded in the backlog rather than fixed here: a code-registered name is
never validated at all, and ReportRunner interpolates it into a temp file
path. The obvious guard throws ArgumentException from ReportBuilder's
constructor, and every ReportConfigCompiler.Compile call site catches only
ConfigurationException — it would turn a bad name into a 500 on POST/PUT
and on the validate endpoint, and stop a host with such a report stored
from starting at all. That needs a design decision, and the input is the
host developer's own literal rather than anything remote.

Full suite: 1 703 green across 33 projects.

Author: thiagoluga

CHANGELOG.md

@@ -8,6 +8,18 @@ The `NeoReports.Abstractions` contract follows SemVer strictly.
 
 ## [Unreleased]
 
+### Fixed
+- **A dynamic report name could end in a newline.** `DynamicReportName.Pattern` was anchored with
+  `$`, which in .NET matches at the end of input **and** immediately before a trailing newline — so
+  a name ending in one was accepted. That name is remotely creatable via `POST /api/reports`, and
+  it reaches a file name on disk, a URL segment, a job record field and every log line about a run.
+  The concrete consequence is the last one: in a plain-text log sink the newline splits the line and
+  lets the name forge a log entry of its own (CodeQL `cs/log-forging` on `ReportJobWorker` and
+  `InMemoryJobScheduler`). Path traversal was never reachable through it — `/`, `\`, `.` and `:` have
+  never been in the character class — so this is the validator not doing what it documented rather
+  than a hole in the file layout. Anchored with `\z`, which means end of input and nothing else. The
+  validator had no tests at all, which is how this survived; it has sixteen now.
+
 ### Added
 - **Optimistic concurrency on report editing (ADR D87).** `GET /api/reports/{name}/config` now returns
   an `ETag`, and `PUT /api/reports/{name}` honours `If-Match`, answering `412 Precondition Failed`

docs/STATUS-AND-BACKLOG.md

@@ -135,6 +135,21 @@ Fixed by excluding the rule itself via `query-filters`, not by a third path twea
 rule at a 100% false-positive rate across two different generators will keep firing every time a
 generator changes shape.
 
+### 1d. A code-registered report name is never validated — open
+
+`AddReport<T>(name, …)` accepts any non-blank string, and `ReportRunner` builds the run's output file
+as `Path.Combine(tempDir, $"{report.Name}.{ext}")`. So `AddReport<T>("../sales", …)` writes outside the
+run's temp directory and escapes its cleanup, and a name with a newline reaches the same log
+statements the dynamic-name fix above just closed.
+
+**Not** fixed alongside that one, deliberately. The obvious guard — reject control characters in
+`ReportBuilder`'s constructor — throws `ArgumentException`, and every `ReportConfigCompiler.Compile`
+call site catches only `ConfigurationException`: it would turn a bad name into a 500 on `POST`/`PUT`
+and on the *validate* endpoint (which exists never to throw), and in `FileStoreRegistryHydrator` it
+would escape the per-report skip and stop the host from starting at all. Doing this properly means
+deciding where a code-first name is validated and with which exception, which is a design question,
+and the input is the host developer's own literal rather than anything remote.
+
 ### 2. CI hardening
 - **Fail (not skip) the Testcontainers integration tests when Docker is absent in CI.** — **done**:
   the five container `ServerFixture`s now swallow a start failure only through an exception filter,

src/NeoReports.Core/Configuration/DynamicReportName.cs

@@ -11,7 +11,15 @@ namespace NeoReports.Core.Configuration;
 public static partial class DynamicReportName
 {
     /// <summary>The validation pattern: starts with a letter, then up to 99 letters/digits/underscore/hyphen.</summary>
-    public const string Pattern = "^[a-zA-Z][a-zA-Z0-9_-]{0,99}$";
+    /// <remarks>
+    /// Anchored with <c>\z</c>, not <c>$</c>. In .NET <c>$</c> also matches immediately BEFORE a
+    /// trailing newline, so <c>^…$</c> accepted a name ending in one — and this validator is the only
+    /// thing standing in front of it. The name reaches a file name on disk, a URL segment, a job
+    /// record and every log line about a run; in a plain-text log sink the newline lets the name forge
+    /// entries (CodeQL cs/log-forging on ReportJobWorker/InMemoryJobScheduler). <c>\z</c> means end
+    /// of input and nothing else.
+    /// </remarks>
+    public const string Pattern = @"^[a-zA-Z][a-zA-Z0-9_-]{0,99}\z";
 
     /// <summary>True when <paramref name="name"/> matches <see cref="Pattern"/>.</summary>
     /// <param name="name">The candidate report name.</param>

tests/NeoReports.AspNetCore.IntegrationTests/ScheduleEndpointTests.cs

@@ -74,7 +74,11 @@ public async Task Setting_a_schedule_for_a_name_no_override_store_can_key_is_ref
         // override under this name. That is the resource's state, not a malformed request — and it
         // must not be the ArgumentException-turned-500 it used to be.
         response.StatusCode.ShouldBe(HttpStatusCode.Conflict);
-        (await response.Content.ReadAsStringAsync()).ShouldContain(DynamicReportName.Pattern);
+        // Read through the parsed body, not the raw JSON: the pattern contains a backslash (it is
+        // anchored with \z, since $ also matches before a trailing newline), and JSON doubles it on
+        // the wire — a substring check against the raw text compares two different encodings.
+        JsonElement body = await response.Content.ReadFromJsonAsync<JsonElement>(Json);
+        body.GetProperty("error").GetString()!.ShouldContain(DynamicReportName.Pattern);
     }
 
     [Fact]

tests/NeoReports.Core.UnitTests/DynamicReportNameTests.cs

@@ -0,0 +1,67 @@
+using NeoReports.Core.Configuration;
+using Shouldly;
+using Xunit;
+
+namespace NeoReports.Core.UnitTests;
+
+/// <summary>
+/// The dynamic-report name validator is the only thing standing between a caller-supplied name and a
+/// file name on disk, a URL segment, a job record field and every log line about a run — and it had no
+/// tests at all, which is how an under-anchored pattern survived.
+/// </summary>
+public class DynamicReportNameTests
+{
+    [Theory]
+    [InlineData("sales")]
+    [InlineData("Sales")]
+    [InlineData("monthly-sales_2026")]
+    [InlineData("a")]
+    public void An_ordinary_name_is_accepted(string name) =>
+        DynamicReportName.IsValid(name).ShouldBeTrue();
+
+    /// <summary>
+    /// The reason this file exists. In .NET, <c>$</c> matches at the end of input <b>and</b>
+    /// immediately before a trailing newline, so <c>^…$</c> accepted a name ending in one. That name
+    /// is remotely creatable (POST /api/reports), and it reaches ReportJobWorker's and
+    /// InMemoryJobScheduler's log statements — where, in a plain-text sink, the newline splits the
+    /// line and lets the name forge a log entry of its own (CodeQL cs/log-forging).
+    /// </summary>
+    [Fact]
+    public void A_name_ending_in_a_newline_is_rejected()
+    {
+        DynamicReportName.IsValid("sales" + (char)10).ShouldBeFalse();
+        DynamicReportName.IsValid("sales" + (char)13 + (char)10).ShouldBeFalse();
+        DynamicReportName.IsValid("sales" + (char)13).ShouldBeFalse();
+    }
+
+    [Fact]
+    public void A_name_with_an_embedded_control_character_is_rejected()
+    {
+        DynamicReportName.IsValid("sa" + (char)10 + "les").ShouldBeFalse();
+        DynamicReportName.IsValid("sales" + (char)9 + "monthly").ShouldBeFalse();
+        DynamicReportName.IsValid("sales" + (char)0).ShouldBeFalse();
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData(" ")]
+    [InlineData("1sales")]          // must start with a letter
+    [InlineData("-sales")]
+    [InlineData("sales monthly")]   // no spaces: it becomes a URL segment
+    [InlineData("sales.monthly")]   // no dots: it becomes a file name
+    [InlineData("../sales")]        // the path-traversal case the type was written for
+    [InlineData("sales/../etc")]
+    public void A_name_outside_the_grammar_is_rejected(string name) =>
+        DynamicReportName.IsValid(name).ShouldBeFalse();
+
+    [Fact]
+    public void Null_is_rejected_rather_than_throwing() =>
+        DynamicReportName.IsValid(null).ShouldBeFalse();
+
+    [Fact]
+    public void The_length_bound_is_enforced()
+    {
+        DynamicReportName.IsValid("a" + new string('b', 99)).ShouldBeTrue();
+        DynamicReportName.IsValid("a" + new string('b', 100)).ShouldBeFalse();
+    }
+}