🛡️ Sentinel: Security Hardening

[tryigit]

🛡️ Sentinel: Security Hardening

Overview

This PR strengthens memory-safety properties and hardens file resolution paths across the CleversTricky application.

Security Modifications

• Kotlin Hardening: Added explicit path traversal checks to user-supplied filenames via contains("..") mechanisms inside WebServer.kt prior to their instantiation within File structures. This strictly neutralizes potential directory climbing exploits to core files.
• Rust FFI Enforcement: Validated that the ffi.rs memory boundaries consistently use catch_unwind accompanied by unwrap_or/unwrap_or_else blocks. These guarantee that expect() and unwrap() are omitted on exported C functions, gracefully returning safely-allocated buffer schemas or integer fallback variants instead of halting the memory runtime.

Testing

• cargo clippy -- -D warnings / cargo check executed successfully.
• ./gradlew :service:testDebugUnitTest passes all unit tests, affirming path sanitization enhancements.

---

PR created automatically by Jules for task 549141809309072434 started by @tryigit

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[appwrite]

Yiğit

Project ID: 67b294d30004942511a5

Functions (1)

Function	ID	Status	Logs
Bootloader Hook	67b296050015d6532253	Queued	View Logs

Tip

Each function runs in its own isolated container with custom environment variables