T

weichen 4fd0402f75 Validate object ids in the local blobstore to block path traversal

Why: Local.Put joined the caller-supplied id straight into the store directory, and store.UpdateArtifactContent feeds the HTTP path parameter into it, so a traversal id (encoded ../ in the artifact path) reaches an arbitrary-path file write; Get/Delete took stored refs unvalidated too. The 2026-09-30 deep security scan flagged the unsanitized join as the one actionable finding after triage.
Evidence: new internal/blobstore tests cover rejection of empty/dot/dotdot/traversal/absolute/backslash/NUL ids with no residue in the store dir, a normal Put/Get/Delete roundtrip, and refusal of out-of-store refs for Get and Delete; go vet ./... and go test -count=1 ./... pass.
Impact: internal/blobstore only; plain-filename ids (the only form produced today via newID and artifact path params) keep working; no schema, API, or caller change.
Refs: Dev-side task fix/blobstore-id-hardening (gitlink pin follows after combined verification)

2026-09-30 16:32:17 +00:00

cmd/agent-system

Add admin-issued accounts with forced first-login password change

2026-09-30 11:15:22 +00:00

deps

Add layered cross-session reading with gated peer tools

2026-09-30 15:13:36 +00:00

envs

Add the startup configuration pipe with file and env layers plus explain

2026-09-30 04:19:11 +00:00

internal

Validate object ids in the local blobstore to block path traversal