anoracleofra-code b37bfc0162 fix: add path traversal guard to updater extraction ...

Validates that every destination path stays within project_root
before writing. Prevents a malicious zip from writing outside
the project directory via ../traversal entries.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Former-commit-id: 3140416e80b1b56e4e6cccc930d11c2d5f9b1611

2026-03-14 14:48:47 -06:00

..

config

v0.7.0: performance hardening — parallel fetches, deferred icons, AIS stability

2026-03-11 06:25:31 -06:00

data

v0.9.5: The Voltron Update — modular architecture, stable IDs, parallelized boot

2026-03-14 14:01:54 -06:00

services

fix: add path traversal guard to updater extraction

2026-03-14 14:48:47 -06:00

tests

v0.9.5: The Voltron Update — modular architecture, stable IDs, parallelized boot

2026-03-14 14:01:54 -06:00

.dockerignore

v0.9.0: in-app auto-updater, ship toggle split, stable entity IDs, performance fixes

2026-03-13 11:32:16 -06:00

.env.example

v0.9.5: The Voltron Update — modular architecture, stable IDs, parallelized boot

2026-03-14 14:01:54 -06:00

ais_proxy.js

v0.9.5: The Voltron Update — modular architecture, stable IDs, parallelized boot

2026-03-14 14:01:54 -06:00

Dockerfile

fix: updater resolves project_root to / in Docker containers

2026-03-14 14:34:11 -06:00

main.py

fix: updater resolves project_root to / in Docker containers

2026-03-14 14:34:11 -06:00

out.json

Initial commit: ShadowBroker v0.1

2026-03-04 22:44:08 -07:00

package-lock.json

Initial commit: ShadowBroker v0.1

2026-03-04 22:44:08 -07:00

package.json

Initial commit: ShadowBroker v0.1

2026-03-04 22:44:08 -07:00

pytest.ini

v0.9.0: in-app auto-updater, ship toggle split, stable entity IDs, performance fixes

2026-03-13 11:32:16 -06:00

requirements-dev.txt

v0.9.0: in-app auto-updater, ship toggle split, stable entity IDs, performance fixes

2026-03-13 11:32:16 -06:00

requirements.txt

v0.9.5: The Voltron Update — modular architecture, stable IDs, parallelized boot

2026-03-14 14:01:54 -06:00

seattle_sample.json

Initial commit: ShadowBroker v0.1

2026-03-04 22:44:08 -07:00

sgp_sample.json

Initial commit: ShadowBroker v0.1

2026-03-04 22:44:08 -07:00

temp.json

Initial commit: ShadowBroker v0.1

2026-03-04 22:44:08 -07:00

wsdot_sample.json

Initial commit: ShadowBroker v0.1

2026-03-04 22:44:08 -07:00