Skip to content

Confine module static file paths - #784

Merged
itsDNNS merged 1 commit into
mainfrom
harden-module-static-path
Aug 10, 2026
Merged

Confine module static file paths#784
itsDNNS merged 1 commit into
mainfrom
harden-module-static-path

Conversation

@itsDNNS

@itsDNNS itsDNNS commented Aug 10, 2026

Copy link
Copy Markdown
Owner

Summary

  • resolve module static-file requests against the canonical registered static root
  • reject traversal, symlink escapes, and missing targets with 404
  • preserve nested module asset delivery and prefix-aware endpoint behavior

Validation

  • complete non-E2E suite: 3534 passed, 2 skipped
  • Python compile and diff checks passed
  • built-in registry, Windows smoke test, and PE verification contracts remain unchanged

Comment thread app/module_loader.py Fixed
Comment thread app/module_loader.py Fixed
@itsDNNS
itsDNNS force-pushed the harden-module-static-path branch from 19c2bfc to 37270b7 Compare August 10, 2026 10:36
@itsDNNS
itsDNNS merged commit 4bb44d1 into main Aug 10, 2026
14 checks passed
@itsDNNS
itsDNNS deleted the harden-module-static-path branch August 10, 2026 10:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants