diff options
| author | Danilo M. <danix@danix.xyz> | 2026-11-02 21:29:50 +0100 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-11-02 21:29:51 +0100 |
| commit | a2b27dade21f85b68654245efefbd339c3e59584 (patch) | |
| tree | 0fb83722f46c6abe7612af6293b3b1c8e1895948 /app/src/test | |
| parent | 32ee99b3243da8c55428538b326b159d03f93f6c (diff) | |
| download | HardenedPass-a2b27dade21f85b68654245efefbd339c3e59584.tar.gz HardenedPass-a2b27dade21f85b68654245efefbd339c3e59584.zip | |
fix(app): compare whole path components in isInsideRepository
The check used a string contains on canonical paths, so a typed name
such as ../store-evil/x resolved to a sibling directory whose path
contains the store's and passed. New entries and folder renames could
then land outside the store.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'app/src/test')
0 files changed, 0 insertions, 0 deletions