Why: Local.Put joined the caller-supplied id straight into the store directory, and store.UpdateArtifactContent feeds the HTTP path parameter into it, so a traversal id reaches an arbitrary-path file write; Get/Delete took stored refs unvalidated too. Flagged by the 2026-09-30 deep security scan, confirmed reachable via the artifact content path parameter.
Evidence: new internal/blobstore tests cover rejection of unsafe ids (no residue), normal roundtrip, and out-of-store ref refusal; go vet and go test -count=1 ./... pass.
Impact: internal/blobstore only; plain-filename ids keep working; no schema, API, or caller change.
Refs: Dev-side task fix/blobstore-id-hardening (gitlink pin follows after combined verification)
Why: Local.Put joined the caller-supplied id straight into the store directory, and store.UpdateArtifactContent feeds the HTTP path parameter into it, so a traversal id reaches an arbitrary-path file write; Get/Delete took stored refs unvalidated too. Flagged by the 2026-09-30 deep security scan, confirmed reachable via the artifact content path parameter.
Evidence: new internal/blobstore tests cover rejection of unsafe ids (no residue), normal roundtrip, and out-of-store ref refusal; go vet and go test -count=1 ./... pass.
Impact: internal/blobstore only; plain-filename ids keep working; no schema, API, or caller change.
Refs: Dev-side task fix/blobstore-id-hardening (gitlink pin follows after combined verification)
Why: Local.Put joined the caller-supplied id straight into the store directory, and store.UpdateArtifactContent feeds the HTTP path parameter into it, so a traversal id (encoded ../ in the artifact path) reaches an arbitrary-path file write; Get/Delete took stored refs unvalidated too. The 2026-09-30 deep security scan flagged the unsanitized join as the one actionable finding after triage.
Evidence: new internal/blobstore tests cover rejection of empty/dot/dotdot/traversal/absolute/backslash/NUL ids with no residue in the store dir, a normal Put/Get/Delete roundtrip, and refusal of out-of-store refs for Get and Delete; go vet ./... and go test -count=1 ./... pass.
Impact: internal/blobstore only; plain-filename ids (the only form produced today via newID and artifact path params) keep working; no schema, API, or caller change.
Refs: Dev-side task fix/blobstore-id-hardening (gitlink pin follows after combined verification)
weichen
merged commit f98dc1ddd4 into main2026-09-30 16:32:39 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: Local.Put joined the caller-supplied id straight into the store directory, and store.UpdateArtifactContent feeds the HTTP path parameter into it, so a traversal id reaches an arbitrary-path file write; Get/Delete took stored refs unvalidated too. Flagged by the 2026-09-30 deep security scan, confirmed reachable via the artifact content path parameter.
Evidence: new internal/blobstore tests cover rejection of unsafe ids (no residue), normal roundtrip, and out-of-store ref refusal; go vet and go test -count=1 ./... pass.
Impact: internal/blobstore only; plain-filename ids keep working; no schema, API, or caller change.
Refs: Dev-side task fix/blobstore-id-hardening (gitlink pin follows after combined verification)