8 Commits

Include renames

Author	SHA1	Message	Date
Gracy769	0d8b50b378	fix(security): deny unresolvable paths and enable Git bash detection on Windows	2026-10-12 22:06:08 +00:00
Gracy769	ac60c3a42d	docs(test): document junction UNC limitation and add mocked UNC link escape test	2026-10-12 22:06:08 +00:00
Gracy769	1f0ded95ed	test: support unprivileged Windows runners with NTFS junction fallback and add mocked escape test	2026-10-12 22:06:08 +00:00
Gracy769	08e22ba4e5	test: add regression test for symlink escape using absolute windows path	2026-10-12 22:05:25 +00:00
Gracy769	acc97a8df7	test: add UNC path test for path extraction and fix windows tests	2026-10-12 22:05:25 +00:00
mlliuz	102bc5ef79	fix: prevent path traversal via session_id in session_store ... load_session/save_session built the session file path directly from the caller-supplied session_id with no validation, so a value like '../../../tmp/secrets' (reachable from the 'load-session' CLI subcommand) could read or write JSON files outside the session directory. Add _validate_session_id() to reject anything outside [A-Za-z0-9_-] (path separators, '..', absolute/Windows paths) before the id is used to build a filename. Legitimate ids (uuid4 hex, 'session-<digits>-<n>') are unaffected. Adds SessionStorePathTraversalTests covering traversal rejection on both load and save plus a legitimate-id round-trip.	2026-10-11 20:31:56 +00:00
陈家名	eb21179dde	fix: validate attached redirection paths	2026-06-08 10:18:48 +08:00
bellman	4af5664ff8	omx(team): auto-checkpoint worker-1 [1]	2026-05-14 17:18:52 +09:00