fix: allow gator catalog filenames containing ..

[immanuwell]

What this PR does / why we need it:

gator policy treats any .. substring as traversal, so a normal catalog file like template..yaml gets rejected. That is a false positive, and it is easy to hit with local file:// catalogs. This patch only rejects real .. path segments, so traversal protection stays intact. small fix, pretty low-risk.

Which issue(s) this PR fixes:

None found. I checked for related gator catalog path issues and PRs. Closest one is #4583, same fetcher, different file path edge case.

Special notes for your reviewer:

Repro before this patch:

fetcher := catalog.NewHTTPFetcher(catalog.DefaultTimeout)
fetcher.SetBaseURL("file:///tmp/catalog.yaml")
_, err := fetcher.FetchContent(context.Background(), "template..yaml")
// err: content path contains path traversal: template..yaml

Checks I ran:

go test ./pkg/gator/... ./cmd/gator/... -count=1
go test -cover -race ./pkg/gator/policy/...
git diff --check

[Copilot]

Pull request overview

This PR fixes a false-positive in the gator policy catalog fetcher. The previous logic rejected any content path containing the substring .., which incorrectly blocked legitimate filenames such as template..yaml when using local file:// catalogs. The fix replaces the substring check with a new containsPathTraversal helper that only flags .. when it appears as a complete path segment (after URL-decoding and cleaning), preserving traversal protection while allowing valid filenames.

Changes:

• Replaced the strings.Contains(..., "..") substring check in FetchContent with a call to a new containsPathTraversal helper.
• Added containsPathTraversal, which URL-decodes and path.Cleans the input, then rejects only true .. path segments.
• Added a unit test verifying that a filename containing .. (template..yaml) is fetched successfully.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
pkg/gator/policy/catalog/fetch.go	Swaps the substring .. check for a segment-aware containsPathTraversal helper that allows legitimate filenames while still rejecting traversal segments.
pkg/gator/policy/catalog/fetch_test.go	Adds a test confirming filenames containing .. are now accepted by FetchContent.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 81.81818% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 44.75%. Comparing base (3350319) to head (22dd1e4).
⚠️ Report is 759 commits behind head on master.

Files with missing lines	Patch %	Lines
pkg/gator/policy/catalog/fetch.go	81.81%	1 Missing and 1 partial ⚠️

❗ There is a different number of reports uploaded between BASE (3350319) and HEAD (22dd1e4). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (3350319)	HEAD (22dd1e4)
unittests	2	1

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4630      +/-   ##
==========================================
- Coverage   54.49%   44.75%   -9.74%     
==========================================
  Files         134      284     +150     
  Lines       12329    20968    +8639     
==========================================
+ Hits         6719     9385    +2666     
- Misses       5116    10775    +5659     
- Partials      494      808     +314     

Flag	Coverage Δ
unittests	44.75% <81.81%> (-9.74%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.