6 Commits

Author	SHA1	Message	Date
Agent	3be1343e00	fix: tighten sandbox mkdirp boundary checks (#30610) (thanks @glitch418x)	2026-03-01 21:41:47 +00:00
glitch418x	687f5779d1	sandbox: allow directory boundary checks for mkdirp	2026-03-01 21:41:47 +00:00
Peter Steinberger	9925ac6a2d	fix(config): harden include file loading path checks	2026-02-26 12:23:31 +01:00
Peter Steinberger	943b8f171a	fix: align windows safe-open file identity checks	2026-02-25 00:42:04 +00:00
junwon	04bcabcbae	fix(infra): handle Windows dev=0 in sameFileIdentity TOCTOU check (#24939) ... * fix(infra): handle Windows dev=0 in sameFileIdentity TOCTOU check On Windows, `fs.lstatSync` (path-based) returns `dev: 0` while `fs.fstatSync` (fd-based) returns the real NTFS volume serial number. This mismatch caused `sameFileIdentity` to always fail, making `openVerifiedFileSync` reject every file — silently breaking all Control UI static file serving (HTTP 404). Fall back to ino-only comparison when either dev is 0 on Windows. ino remains unique within a single volume, so TOCTOU protection is preserved. Fixes #24692 * fix: format sameFileIdentity wrapping (#24939) --------- Co-authored-by: Peter Steinberger <steipete@gmail.com>	2026-02-24 03:33:27 +00:00
Peter Steinberger	13db0b88f5	refactor(gateway): share safe avatar file open checks	2026-02-22 23:12:45 +01:00