jpmschweitzerandClaude 816e60d028 reject path traversal in files.read and files.ls (T-78) ...

Both handlers concatenated the request path onto the workspace root
without validating containment, letting `path: "../../../etc/passwd"`
escape the workspace. resolveUnderRoot normalizes the path and
checks containment under root.absolute.path before any filesystem
access.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-05-05 15:02:30 +02:00

..

a11y

dart format whole tree

2026-05-03 21:51:59 +02:00

builtin

fix test suite — green on make test

2026-05-03 21:52:39 +02:00

cli

dart format whole tree

2026-05-03 21:51:59 +02:00

daemon

fix test suite — green on make test

2026-05-03 21:52:39 +02:00

editor

dart format whole tree

2026-05-03 21:51:59 +02:00

extension/src

dart format whole tree

2026-05-03 21:51:59 +02:00

files

reject path traversal in files.read and files.ls (T-78)

2026-05-05 15:02:30 +02:00

git

dart format whole tree

2026-05-03 21:51:59 +02:00

goldens

dissolve app/ into repo root (D-056)

2026-04-23 00:37:20 +02:00

helpers

dart format whole tree

2026-05-03 21:51:59 +02:00

ipc

dart format whole tree

2026-05-03 21:51:59 +02:00

kernel/src

fix sidebar order and ptyc status bar warning

2026-05-03 22:22:23 +02:00

panes

fix test suite — green on make test

2026-05-03 21:52:39 +02:00

pty

fix test suite — green on make test

2026-05-03 21:52:39 +02:00

widgets

dart format whole tree

2026-05-03 21:51:59 +02:00