Skip to content

v0.26.1

Latest
Latest

Choose a tag to compare

View all tags
@rizumita rizumita released this 04 Jan 23:49
· 3 commits to main since this release
v0.26.1
90293e0
This commit was signed with the committer’s verified signature.
rizumita Ryoichi Izumita
SSH Key Fingerprint: WjrL6/OwW4Tz4Iryvs0rJHdbhegjzHNPd0FCWZomoZk
Verified
Learn about vigilant mode.

Fixed

  • Improve path traversal detection accuracy (PR #214): Fix false positives for Next.js catch-all routes ([...all])
    • Changed from substring match (includes("..")) to path segment check (split(/[/\\]/).includes(".."))
    • Added 24 unit tests for normalizePathForDenylist function

Full Changelog: v0.26.0...v0.26.1

Assets 2
Loading