SnapOtter c1cd8712f4 fix(security): close file-preview path-injection + tighten subtitle detection ...

- file-preview.ts: validate the :id URL param against a safe charset and
  restrict the original-name extension to alphanumerics before they feed
  filesystem paths (closes 9 CodeQL js/path-injection; defense-in-depth on
  top of the existing DB lookup).
- media-input.ts: require the SRT/VTT timecode structure to detect a subtitle
  rather than a bare '-->' (closes CodeQL js/bad-tag-filter; also rejects
  non-subtitle files that merely contain '-->').

2026-06-21 11:31:39 +08:00

..

api

fix(security): close file-preview path-injection + tighten subtitle detection

2026-06-21 11:31:39 +08:00

demo

feat!: SnapOtter 2.0.0

2026-06-17 14:33:09 +08:00

docs

feat(modality): rename "file" modality label "Data" -> "Files"

2026-06-21 02:45:56 +08:00

landing

fix(e2e,landing): robust path escaping (CodeQL) + unique file-tools card

2026-06-21 03:25:45 +08:00

web

feat(modality): rename "file" modality label "Data" -> "Files"

2026-06-21 02:45:56 +08:00