Skip to content

fix(studio): contain preview paths during packing - #10

Merged
Wangnov merged 1 commit into
mainfrom
fix/preview-path-traversal
Jul 18, 2026
Merged

fix(studio): contain preview paths during packing#10
Wangnov merged 1 commit into
mainfrom
fix/preview-path-traversal

Conversation

@Wangnov

@Wangnov Wangnov commented Jul 18, 2026

Copy link
Copy Markdown
Owner

Summary

  • validate canonical previews/.../*.webp paths before any filesystem lookup
  • anchor preview resolution to previews/ and reject traversal, hidden segments, backslashes, and symbolic-link escapes
  • add direct regression coverage for the review case and physical-path containment

Validation

  • npm run check
  • npm test — 42 passed
  • packed all 50 existing skins successfully
  • codex review --uncommitted — no findings

Addresses the review thread from #9: #9 (comment)

@Wangnov
Wangnov merged commit 2472d4e into main Jul 18, 2026
2 checks passed
@Wangnov
Wangnov deleted the fix/preview-path-traversal branch July 18, 2026 17:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant