fix(runtime): bound tenant resource amplification

2026-08-09 12:40:59 +00:00 · 2026-07-29 18:27:44 +08:00
parent e8d90c4259
commit 610915b9c5
32 changed files with 857 additions and 185 deletions
@@ -564,7 +564,11 @@ class WebSocketAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter)
                raise ValueError('Attachment key does not belong to this WebSocket connection')

            try:
-                file_content = await storage_mgr.storage_provider.load(comp_path)
+                file_content = await storage_mgr.load_scoped_object_key(
+                    execution_context,
+                    comp_path,
+                    expected_owner_type='upload_image',
+                )
                base64_str = (await asyncio.to_thread(base64.b64encode, file_content)).decode('utf-8')

                lowered = comp_path.lower()