05357580ae
- Fix isValidProjectRoot() in 4 API routes to properly prevent path traversal
by using path.relative() to ensure paths stay within allowed base directory
(replaces ineffective normalized.includes('..') check)
- Fix readiness-report.mjs to remove misleading path traversal validation
that was ineffective after path.resolve() removes '..' segments
- Fix asNonEmptyString() in mutations.ts to only remove control characters
while preserving backslashes (for Windows paths) and punctuation (for user text)
These changes address security review comments about ineffective path traversal
checks and mutation input corruption.
|
||
|---|---|---|
| .. | ||
| lib | ||
| generate-agent-name.mjs | ||
| readiness-report.mjs | ||
| resolve-bb.mjs | ||
| session-preflight.mjs | ||