Skip to content

v2.0.38 - Symlink containment completed for convert CLI

Latest

Choose a tag to compare

@mickdarling mickdarling released this 04 Jul 18:49
0bbd0c1

What's Changed

  • Symlink containment completed (#2342, #2343, #2344, #2346) — closes both path-security bypasses for convert CLI output paths, including the remaining case disclosed in the v2.0.37 release notes:
    • Output directories that do not exist yet are vetted through their nearest existing ancestor (#2343).
    • Canonical containment (#2346): relative outputs — including the default — must truly resolve inside the working directory, even when a symlink (or a symlink whose target already contains matching subdirectories) tries to redirect them. Explicit outside destinations disclose their real location when a symlink diverts them, and writes always use the vetted canonical path.

No known path-security issues remain open.

Full Changelog: v2.0.37...v2.0.38