SnapOtterandGitHub 43334324c4 fix(api): contain library stored-name path traversal (#600) ...

The library file-storage helpers joined FILES_STORAGE_PATH with a database stored_name and never checked containment, so a crafted name could read or delete files outside the storage root after a malicious 1.x SQLite import (which copies stored_name verbatim). Add assertSafeStoredName() and apply it in every helper that resolves a stored name to a path, matching the containment guard object-storage already uses.

Reported by Alpesh Bhagwatkar.

2026-07-21 07:30:46 +00:00

..

assets/frames

feat(beautify): add device frame assets and PNG frame compositing

2026-05-08 16:12:46 +08:00

db

fix: make OCR portable and reliable across AMD64 and ARM64 (#519)

2026-07-15 03:34:24 +08:00

jobs

fix(jobs): make timeout messages tool-agnostic and CPU-aware (#596)

2026-07-21 15:22:57 +08:00

lib

fix(api): contain library stored-name path traversal (#600)

2026-07-21 07:30:46 +00:00

modality

fix(pdf): stop page tools failing on short and encrypted PDFs (#594)

2026-07-21 06:14:43 +00:00

plugins

feat(telemetry): Sentry + PostHog quality pass (#546)

2026-07-17 01:51:48 +00:00

routes

fix(api): enforce job ownership on cancel endpoint (#599)

2026-07-21 15:09:00 +08:00

config.ts

feat: add Fastify API server with health check and env config

2026-03-22 02:46:34 +08:00

index.ts

fix(api): enforce job ownership on cancel endpoint (#599)

2026-07-21 15:09:00 +08:00

instrument.ts

feat(telemetry): Sentry + PostHog quality pass (#546)

2026-07-17 01:51:48 +00:00

openapi.ar.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.de.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.es.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.fr.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.hi.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.id.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.it.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.ja.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.ko.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.nl.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.pl.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.pt-BR.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.ru.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.sv.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.th.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.tr.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.uk.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.vi.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.zh-CN.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

openapi.zh-TW.yaml

feat: clearer, disambiguated tool names across all surfaces (#520)

2026-07-15 21:55:51 +08:00

permissions.ts

fix(security): harden auth and outbound fetches

2026-06-29 17:54:12 +08:00

tracing.ts

fix(enterprise): ship enterprise package in prod image + S3, analytics, tracing, queue fixes (#342)

2026-06-24 17:27:59 +08:00