mirror of
https://github.com/getAlby/hub.git
synced 2026-08-13 12:33:39 +02:00
fa5cc3511e
Archive entry names come from the uploaded backup and were joined to the restore directory without validation, so an entry name containing ".." segments could resolve to a path outside it. Reject entries whose name is absolute or escapes the restore directory, and confirm the cleaned destination path stays within it before writing. Add a test covering rejection of an entry that points outside the restore directory. Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| api.go | ||
| api_test.go | ||
| apps_test.go | ||
| backup.go | ||
| backup_test.go | ||
| esplora.go | ||
| lsp.go | ||
| models.go | ||
| rebalance.go | ||
| transactions.go | ||
| transactions_test.go | ||