Skip to content
This repository was archived by the owner on May 23, 2026. It is now read-only.

v0.7.2 — Directory Traversal Fix

Choose a tag to compare

View all tags
@magifd2 magifd2 released this 19 Apr 00:54
· 26 commits to main since this release
v0.7.2
6c75599

Security Fix

Fixes directory traversal bypass reported in code review follow-up.

  • Root cause: filepath.IsAbs() check allowed relative paths like ../../../etc/passwd to skip allowlist validation
  • Fix: All candidate paths resolved to absolute via filepath.Abs() before allowlist check, with separator-aware prefix matching to prevent partial directory name collisions

Full changelog: https://github.com/nlink-jp/shell-agent/blob/main/CHANGELOG.md

Assets 3
Loading