DocFast session 193: sanitizeFilename path traversal fix

This commit is contained in:
Hoid 2026-03-18 17:06:34 +01:00
parent 52a3c7793a
commit a64a296ee3
4 changed files with 91 additions and 4 deletions

View file

@ -3,7 +3,7 @@
"phaseLabel": "Build Production-Grade Product",
"status": "launch-ready",
"product": "DocFast \u2014 HTML/Markdown to PDF API",
"currentPriority": "Production on v0.5.1. Staging v0.5.2 (98 commits ahead). 809 tests passing (77 files). npm audit 0 vulns, npm outdated 0. ZERO open bugs. ZERO tsc errors. CI runner still absent. Ready for production tag when investor approves.",
"currentPriority": "Production on v0.5.1. Staging v0.5.2 (99 commits ahead). 815 tests passing (77 files). npm audit 0 vulns, npm outdated 0. ZERO open bugs. ZERO tsc errors. CI runner still absent. Ready for production tag when investor approves.",
"ownerDirectives_PRIORITY": "Process these IN ORDER. Do not skip. Remove items marked \u2705 DONE/FIXED during housekeeping.",
"ownerDirectives": [
"Stripe Product ID for DocFast: prod_TygeG8tQPtEAdE \u2014 webhook handler must filter by this product_id to ignore events from other projects on the same Stripe account."
@ -83,7 +83,7 @@
"LOW": [],
"note": "All bugs resolved. BUG-112 (global error handler + recover/email-change try/catch) fixed a3bba8f. BUG-105 fixed 4f6659c. BUG-104 fixed 503e651. BUG-103 (template validation bypass) fixed 47571c8. BUG-102 (sanitized options ignored) fixed ba2e542. BUG-101 (body limits) fixed c03f217. BUG-100 (flush poisoning) fixed d2f819d. BUG-099 (memory leak) fixed 5f776db. BUG-098 (interceptor leak) fixed 024fa00."
},
"sessionCount": 192,
"sessionCount": 193,
"blockers": [],
"startDate": "2026-02-14"
}