5ymb01 f0dc094cd6 fix(security): use Path.relative_to() for path confinement (#284) ...

* fix(security): use Path.relative_to() for path confinement check

Replace str.startswith() path check with Path.relative_to() in the
plugin file viewer endpoint. startswith() can be bypassed when a
directory name is a prefix of another (e.g., /plugins/foo vs
/plugins/foobar). relative_to() correctly validates containment.

Co-Authored-By: 5ymb01 <noreply@github.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore: trigger CodeRabbit review

---------

Co-authored-by: 5ymb01 <5ymb01@users.noreply.github.com>
Co-authored-by: 5ymb01 <noreply@github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-20 10:04:49 -04:00

..

__init__.py

Plugins (#145)

2025-12-27 14:15:49 -05:00

api_v3.py

fix(security): use Path.relative_to() for path confinement (#284)

2026-03-20 10:04:49 -04:00

pages_v3.py

fix(security): mask secret fields in API responses and extract helpers (#276)

2026-03-08 20:41:18 -04:00