Sebastion 195f6efeff fix: prevent path traversal in LocalStorageProvider via key parameter (#2087) ...

Add _safe_resolve() helper that uses os.path.realpath() to canonicalize
the joined path and verifies it stays within LOCAL_STORAGE_PATH.

All six public methods (save, load, exists, delete, size,
delete_dir_recursive) now validate the key before performing any I/O.

This prevents absolute-path injection (e.g. key="/etc/passwd") and
relative traversal (e.g. key="../../etc/passwd") from escaping the
storage root directory.

CWE-22

2026-04-24 15:46:37 +08:00

..

__init__.py

Add S3 object storage protocol support (#1780)

2025-11-14 10:09:26 +08:00

test_localstorage_path_traversal.py

fix: prevent path traversal in LocalStorageProvider via key parameter (#2087)

2026-04-24 15:46:37 +08:00

test_storage_provider_selection.py

chore: Add PyPI package support for uvx/pip installation (#1764)

2025-11-16 19:53:01 +08:00