External/ignis
1
0
Fork 0
mirror of https://github.com/Nystik-gh/ignis.git synced 2026-06-17 04:35:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

harden demo sessions

Browse Source
This commit is contained in:
Nystik
2026-06-08 15:43:15 +02:00
parent 9d01ce71bc
commit 62d87af7dd
4 changed files with 42 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
apps/ignis-server/server/demo/demo-provision.js
View File

@@ -80,6 +80,14 @@ async function provisionVault(sessionId, userVaultName) {
const storageName = makeStorageName(sessionId, userVaultName);
const vaultPath = path.join(config.vaultRoot, storageName);
// keep the resolved path inside the vault root.
const root = path.resolve(config.vaultRoot);
const resolved = path.resolve(vaultPath);
if (resolved !== root && !resolved.startsWith(root + path.sep)) {
return { error: "invalid-vault-name" };
}
await fsp.mkdir(config.vaultRoot, { recursive: true });
try {