Skip to content

v0.3.2

Choose a tag to compare

View all tags
@zk-xyz zk-xyz released this 05 Apr 20:58
v0.3.2
5e37a3c

Security

  • DNS rebinding fix: Outbound fetches now pin to the validated IP address on every hop, closing the TOCTOU window between DNS resolution and TCP connection. Uses a custom lookup callback on http.request/https.request so the socket connects to the vetted IP.
  • Centralized path containment: All .brand/ writes and cwd-scoped file reads use a shared assertPathWithinBase() helper, eliminating sibling-prefix traversal escapes.
  • Regression tests: New tests for pinned transport behavior and path traversal edge cases.

Upgrade recommended for all users of v0.3.0 and v0.3.1.

Assets 2
Loading