OrbisAI Security aa2aac68b0 fix(V-009): reject Windows drive-letter paths in session field validation ...

Extends the CWE-22 path traversal guard to cover Windows absolute paths
of the form C:/... and D:\... — previously only leading / and \ were
checked, which missed drive-letter prefixes. Replaces the inline
startswith check with a compiled module-level regex (_TRAVERSAL_RE) that
covers all three attack patterns: .., leading /\, and leading X: drives.
Adds two regression tests for C:/windows/system32 and D:\\path\\to\\file.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-21 15:23:36 -07:00

..

assets

fix: improve telegram topic mode setup

2026-05-04 12:07:17 -07:00

builtin_hooks

remove: BOOT.md built-in hook (#17093)

2026-04-28 09:50:27 -07:00

platforms

feat(gateway): typed send-error classification (SendResult.error_kind) (#50342)

2026-06-21 12:34:22 -07:00

relay

fix(relay): make hosted gateways actually connect AND complete the inbound/outbound round-trip (#48828)

2026-06-19 16:30:24 +10:00

__init__.py

docs(gateway): mention Weixin in gateway help and docstrings

2026-05-12 17:08:51 -07:00

authz_mixin.py

fix(gateway): preserve WeCom per-group sender allowlists

2026-06-13 07:18:54 -07:00

channel_directory.py

fix: harden WhatsApp target alias salvage

2026-06-15 05:51:47 -07:00

config.py

refactor(gateway): migrate slack/dingtalk/whatsapp/matrix/feishu/telegram/wecom/email/sms adapters to bundled plugins

2026-06-20 10:26:45 -07:00

delivery.py

fix(gateway): drop outbound silence-narration messages pre-send

2026-05-29 19:06:05 -07:00

display_config.py

feat(gateway): rename to tool_progress_grouping, add config/docs/tests

2026-06-16 05:49:24 -07:00

hooks.py

feat(hooks): expose thread_id and chat_type in agent:start/end context (#41672)

2026-06-07 19:16:36 -07:00

kanban_watchers.py

fix(kanban): honor kanban.auto_decompose toggle live, without a gateway restart (#50358)

2026-06-21 12:43:44 -07:00

memory_monitor.py

Port from cline/cline#10343: periodic gateway memory logging (#27102)

2026-05-16 12:55:23 -07:00

message_timestamps.py

feat(gateway): inject stable human-readable message timestamps

2026-06-16 15:49:59 -07:00

mirror.py

refactor(gateway): drop _append_to_jsonl from mirror

2026-05-20 13:00:57 -07:00

pairing.py

fix(gateway): preserve WhatsApp pairing approvals across JID/LID alias flips

2026-05-23 01:46:34 -07:00

platform_registry.py

refactor(plugins): add apply_yaml_config_fn registry hook

2026-05-13 22:20:30 -07:00

response_filters.py

fix(gateway): suppress exact silence tokens without mutating history

2026-06-14 03:25:08 -07:00

restart.py

fix(gateway): address restart review feedback

2026-04-10 21:18:34 -07:00

rich_sent_store.py

fix(telegram): resolve replies to rich (sendRichMessage) messages

2026-06-16 13:04:20 -07:00

run.py

fix(gateway): pause Telegram typing before stream finalize

2026-06-21 13:10:25 -07:00

runtime_footer.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

session_context.py

fix(api-server): stop silently promising async delivery on stateless HTTP path (#50319)

2026-06-21 12:15:14 -07:00

session.py

fix(V-009): reject Windows drive-letter paths in session field validation

2026-06-21 15:23:36 -07:00

shutdown_forensics.py

chore: ruff auto-fixes — collapsible-else-if, if-stmt-min-max, dict.fromkeys (#23926)

2026-05-11 11:03:29 -07:00

slash_access.py

feat(gateway): per-platform admin/user split for slash commands (salvage of #4443) (#23373)

2026-05-10 12:33:54 -07:00

slash_commands.py

fix(model-switch): a failed in-place swap must be a no-op, not a dead session (#50375)

2026-06-21 13:33:23 -07:00

status.py

refactor(gateway): route all active_agents coercion through parse_active_agents; harden drain-timeout fallback

2026-06-21 17:22:52 +05:30

sticker_cache.py

fix: guard yaml.safe_load, flock unlock, TOCTOU races, and atomic writes

2026-05-19 00:12:41 -07:00

stream_consumer.py

fix(gateway): respect adapter decline of fresh-final to prevent double delivery

2026-06-21 13:55:50 -07:00

stream_dispatch.py

feat(gateway): structured stream-event protocol + Telegram draft formatting parity (#37250)

2026-06-02 00:33:50 -07:00

stream_events.py

feat(gateway): structured stream-event protocol + Telegram draft formatting parity (#37250)

2026-06-02 00:33:50 -07:00

whatsapp_identity.py

fix(whatsapp): normalize bare phone targets to JIDs before bridge send

2026-06-21 13:32:22 -07:00