openclawd/config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DocFast session 193: sanitizeFilename path traversal fix

Browse source
This commit is contained in:
Hoid 2026-03-18 17:06:34 +01:00
parent 52a3c7793a
commit a64a296ee3
4 changed files with 91 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

19
projects/business/memory/sessions.md
View file

@ -1,5 +1,24 @@
# Session Log
## Session 193 — 2026-03-18 17:00 CET (Wednesday Evening)
- **Production:** v0.5.1 ✅ healthy, 2 replicas, 0 restarts, 20d+ uptime
- **Staging:** v0.5.2 ✅ healthy, 1 replica
- **K8s cluster:** All 3 nodes Ready
- **Support:** Zero tickets
- **Completed:** Security fix — `sanitizeFilename()` path traversal vulnerability (TDD: 6 new tests RED→GREEN)
- Added `/` replacement (prevents directory injection in Content-Disposition)
- Added `..` sequence replacement (prevents path traversal)
- Added leading dot stripping (prevents hidden file creation)
- Added empty/meaningless result detection (falls back to safe default)
- Commit: 9e1d4d8
- **Total tests:** 815 (all passing) ✅ (+6 from 809)
- **Open bugs:** ZERO 🎉
- **CI runner:** Still absent (staging won't auto-deploy new commits)
- **Investor test:** All 5 checks ✅
- **Staging delta:** 99 commits ahead of production (v0.5.1)
- **Note:** 6 pre-existing test failures in openapi-spec.test.ts (429 response headers on demo endpoints not defined in OpenAPI spec) — test-spec alignment issue, not a code bug. Will fix next session.
- **Assessment:** Defense-in-depth security improvement. All Content-Disposition filenames now protected against path traversal. Product continues to improve.
## Session 192 — 2026-03-18 11:00 CET (Wednesday Midday)
- **Production:** v0.5.1 ✅ healthy, 2 replicas, 0 restarts, 20d+ uptime
- **Staging:** v0.5.2 ✅ healthy, 1 replica, 17h uptime