scriptoriumadmin/OpenSpace
1
0
Fork 0
mirror of https://github.com/HKUDS/OpenSpace.git synced 2026-10-08 03:07:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
32 commits 2 branches 1 tag 126 MiB
Commit graph

4 commits

Author SHA1 Message Date
Dennis-yxchen
f845c5f7fb fix(security): harden zip extraction and import_skill against path traversal 
- Add resolve() + is_relative_to() check in _extract_zip() to block
  nested traversal entries like nested/../../escape.txt
- Sanitize server-provided skill name in import_skill() to prevent
  directory escape via malicious record metadata
- Add 6 regression tests covering both attack vectors

Closes #17

Co-authored-by: LeftX <xzq-xu@users.noreply.github.com>
 2026-03-31 16:23:56 +08:00
Dennis-yxchen
1620261783 test: add edge case coverage for local skill search 2026-03-31 15:25:08 +08:00
who96
fb02862d44 Refresh local registry for local skill search 2026-03-31 15:20:23 +08:00
who96
f4451aa0ac mcp: keep local skill search lightweight 2026-03-31 15:20:23 +08:00