Skip to content

STUdio 0.4.3-fork.2

Pre-release
Pre-release

Choose a tag to compare

View all tags
@antoinevalentinHA antoinevalentinHA released this 06 Sep 09:24
· 8 commits to master since this release
0.4.3-fork.2
2f65474
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security fix

  • Windows static path traversal fixed before StaticHandler.
  • Positive allowlist on normalized static paths — RFC 3986 unreserved characters plus the separator, not a denylist.
  • Traversal outside the web root is rejected (404).
  • Real bundled assets remain accepted, the tilde in runtime~main.<hash>.js included.
  • No Vert.x migration.
  • Loopback-only bind retained.

This replaces 0.4.3-fork.1, whose archive was withdrawn for that traversal (#42).

Validation

  • Linux + Windows CI.
  • Java 289, JavaScript 57.
  • StaticResourceConfinementTest passes on Windows.
  • Packaged artifact inspected: version 0.4.3-fork.2, the fix present in the bundled jar.

Scope

  • Still a pre-release.
  • Existing documented limitations remain — see TESTING.md and FIELD-VALIDATION.md.
  • No crash-safety claim.
  • No broad platform-support claim.

Installation

Download studio-web-ui-0.4.3-fork.2-dist.zip below, unzip, and run the launcher for your platform, as the README describes. Requirements are unchanged: Java JDK 11+, and on Windows the libusb driver.

SHA-256

eb04332f007163dbe5de989ab0aa4862e0f04b9e7d8a0714802edc6ae4382594  studio-web-ui-0.4.3-fork.2-dist.zip

Based on STUdio by @marian-m12l. Licensed under the Mozilla Public License 2.0. Lunii is a registered trademark of Lunii SAS; this work is in no way affiliated with Lunii SAS. Use at your own risk — no warranty, and it may brick your device.

Assets 3
Loading