weichen/Agent-System-Dev
1
0
Fork 0
Code Issues 1 Pull Requests 2 Actions 2 Packages Projects Releases Wiki Activity

Pin backend gitlink to the blobstore id validation fix #84

Merged
weichen merged 4 commits from fix/blobstore-id-hardening into main 2026-09-30 16:38:49 +00:00
Conversation 0 Commits 4 Files Changed 2
+28
4 Commits
Author SHA1 Message Date
weichen ac0f565930 Record the sync checkpoint
ci / test (pull_request) Failing after 30s
Details
2026-09-30 16:38:22 +00:00
weichen 290b9bbd26 Merge remote-tracking branch 'origin/main' into fix/blobstore-id-hardening 2026-09-30 16:38:22 +00:00
weichen 7a65410cec Pin backend gitlink to the blobstore id validation fix 
Why: the 2026-09-30 deep security scan triage left one actionable finding: backend Local.Put joined the HTTP-supplied artifact id into the store directory unsanitized (reachable via UpdateArtifactContent path parameter), and Get/Delete took stored refs unvalidated. Backend PR #22 adds validID on Put plus a directory-containment check on Get/Delete with unit tests.
Evidence: backend go vet ./... and go test -count=1 ./... pass (3 new blobstore test groups green); Dev make test combined verification exit 0 across core+backend+frontend+ui+agentcmd (log tail shows test-ui 37/37, agentcmd ok); gitlink pinned to backend main f98dc1d after confirming it already contains the chat-process pointer 76d64a1 (no regression).
Impact: modules/backend gitlink only (+task card); no Dev-repo code change.
Refs: .task/fix-blobstore-id-hardening.md, backend PR #22
 2026-09-30 16:34:01 +00:00
weichen cf34cf93fa Record the task card for fix-blobstore-id-hardening 2026-09-30 16:28:31 +00:00