copilotkit__copilotkit/.dockerignore at fae400eddffb18a0eef20c8cb667d40a39983f5a - copilotkit__copilotkit - GetSkill.work

skills/copilotkit__copilotkit

mirror of https://github.com/CopilotKit/CopilotKit.git synced 2026-09-14 16:26:20 +08:00

Files

T

Jordan Ritter 25d8f6fb60 fix(showcase/shell-docs): guard ag-ui + reference filesystem reads against path traversal

The ag-ui and reference catch-all routes accept arbitrary URL segments
and feed them directly to path.join(CONTENT_DIR, slugPath) + fs.readFileSync.
A crafted request like /ag-ui/..%2F..%2Fsecrets decodes to a slugPath
that path.join happily resolves outside CONTENT_DIR, leaking arbitrary
files on disk.

Route every user-controlled filesystem access through the existing
safe-fs helpers (resolveWithinDir / safeReadFileSync) so escapes
return a safe miss and fall through to notFound().

2026-04-20 17:13:14 -07:00

27 lines

280 B

Plaintext

Raw Blame History

 .github
 .husky
 .turbo
 community
 assets
 .vscode
 Dockerfile
 **/.venv
 **/.env
 **/.env.local
 **/.env.*.local
 **/.vscode
 infra
 docs
 **/.turbo
 **/.husky
 **/.next
 **/coverage
 **/dist
 **/build
 **/__pycache__
 **/.pytest_cache
 **/.git
 **/.DS_Store
 **/node_modules
 **/.langgraph_api
 **/*.log