SnapOtter 7a3b4e6b3b fix(security): basename-sanitize file-preview paths (CodeQL js/path-injection) ...

The resolve()+startsWith containment check was correct but CodeQL did not
recognize it. Apply path.basename() to the name in resolveWithinPreviewDir -- a
sanitizer CodeQL recognizes -- so every id-derived preview path is provably a
single filename inside the preview dir. Behaviour is unchanged for valid ids
(already charset-validated); containment check kept as a backstop.

2026-06-21 14:32:16 +08:00

..

api

fix(security): basename-sanitize file-preview paths (CodeQL js/path-injection)

2026-06-21 14:32:16 +08:00

demo

feat!: SnapOtter 2.0.0

2026-06-17 14:33:09 +08:00

docs

feat(modality): rename "file" modality label "Data" -> "Files"

2026-06-21 02:45:56 +08:00

landing

fix(e2e): disable Astro Dev Toolbar during landing e2e tests

2026-06-21 12:13:48 +08:00

web

feat(modality): rename "file" modality label "Data" -> "Files"

2026-06-21 02:45:56 +08:00