Skip to content

Version 1.0.11

Choose a tag to compare

View all tags
@gmegidish gmegidish released this 14 Oct 15:53
· 7 commits to main since this release
1.0.11
This tag was signed with the committer’s verified signature.
gmegidish Gil Megidish
SSH Key Fingerprint: kXJSWvdRFJs2EcvwpFYl+0SxPc0VHJonK2urhoRpKWY
Verified
Learn about vigilant mode.
d4a83fa
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
  • Security: Output paths are resolved through every symlink before checking the allowed directories, so a symlink can no longer redirect a screenshot, log or recording outside them (#506), thanks to @ppjsw, @TBernard97, @barnessomer and @arpitjain099
  • Security: Output paths with a symlink cycle or too many levels of symbolic links are rejected (#507), thanks to @TBernard97, @barnessomer and @arpitjain099
  • Security: The filesystem root and the home directory are never treated as an allowed output directory, even when the server is started from them (#508), thanks to @barnessomer
  • Security: Screenshots and device logs are written with O_NOFOLLOW, so a symlink planted after validation cannot redirect the write (#509), thanks to @barnessomer and @arpitjain099
  • Security: Screen recordings are recorded into a private directory and moved to the output when done, never written through a symlink (#510), thanks to @barnessomer
  • Fix: mobile_open_url accepts a url with an upper-case scheme, such as HTTPS:// (#478)
  • Fix: mobile_swipe_on_screen rejects a non-positive swipe distance (#499)
  • Fix: The build script works on Windows (#501)
  • Fix: mobile_press_button lists every button it accepts, per platform, including BACKSPACE, APP_SWITCH, POWER and LOCK (#500)
  • Fix(iOS): The agent is installed automatically on a simulator that does not have it yet (#498), thanks to @sxh313
  • Chore: Upgrade mobilewright to 0.0.66 (#505)
Assets 2
Loading