Skip to content

v0.1.12

Choose a tag to compare

View all tags
@BASIC-BIT BASIC-BIT released this 01 Sep 20:49
v0.1.12
37d1f41
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[AGENT]

Changes

  • Add individually grantable vrchat_group_image_upload for uploading a validated static PNG to the signed-in account gallery without attaching it to a group post or event. The supplied group is an authorization boundary, not the upload destination.
  • Require the write guard, resolved group allowlist, and absolute uploads.allowedRoots containment before local file intake.
  • Reject symbolic links, junction escapes, replacement races, malformed PNGs, APNG, compressed-profile, excessive-chunk, and IDAT decompression bombs, width or height outside 65 through 2048 pixels inclusive, and files over 10 MiB.
  • Treat upload transport failures as indeterminate and suppress automatic retry because the upstream write may already have succeeded. Reconcile the gallery before retrying.
  • Keep both generic image upload operations out of raw and generated write surfaces, and use the live-verified multipart POST /file/image route only through the curated tool.
Assets 2
Loading