🛡️ Sentinel: [CRITICAL] Fix Path Traversal in File Download - #41
🛡️ Sentinel: [CRITICAL] Fix Path Traversal in File Download#41google-labs-jules[bot] wants to merge 1 commit into
Conversation
- Refactor `DownloadImageProcessor.processName` to strictly sanitize filenames. - Refactor `AssetsProcessor.processNames` and `normalizeAssetName` for consistency. - Remove control characters, normalize separators, and replace `..` with `__`.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🚨 Severity: CRITICAL
💡 Vulnerability: Path Traversal via malicious filenames
🎯 Impact: Attackers could potentially write files outside the intended directory by using filenames containing
..or control characters.🔧 Fix: Implemented strict filename sanitization in
DownloadImageProcessorandAssetsProcessor.✅ Verification: Code review confirmed sanitization logic covers backslashes, path traversal, and reserved characters. Tests could not be run due to environment issues.
PR created automatically by Jules for task 4393706056608914041 started by @alexey1312