BitSquare/Codeman
2
0 Fork 0
mirror of https://github.com/Ark0N/Codeman.git synced 2026-10-20 09:09:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(preview): refuse a bare ~ folder in a Docker case too (#604 merge-time fix)

Browse Source 
The Docker refusal on POST /api/sessions/:id/folders tested only `~/`, but
listFolder also expands a bare `~` to this host's home, so a Docker case
could list and serve the host home through it (the preview's "Show folder"
for a `~/x.png` link reached it with no typing). A bare `~` now gets the same
400.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Codeman maintainer committed 2026-10-13 18:08:38 +02:00
1 parent 90034d07d7
commit 076f62fa1b
2 files changed
+4 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/web/routes/file-routes.ts
+2 -1
View File
@@ -2404,7 +2404,8 @@ export function registerFileRoutes(app: FastifyInstance, ctx: SessionPort & Even
reply.code(400).send(createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Missing folder path'));
return;
}
if (scope.docker && body.path.startsWith('~/')) {
// A bare `~` expands to this host's home too, not the container's.
if (scope.docker && (body.path === '~' || body.path.startsWith('~/'))) {
reply.code(400).send(createErrorResponse(ApiErrorCode.INVALID_INPUT, DOCKER_HOME_PATH_ERROR));
return;
}