sencho

mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-07 09:24:09 +00:00

Files

T

Anso 77f27b4bf9 refactor(backend): defensive path validation in FileSystemService (#802 )

Adds two private helpers and routes the legacy stack-scoped methods
through them so every fs call has a name + path check immediately
above the call site:

- assertWithinBase(filePath): throws INVALID_PATH if the path resolves
  outside this.baseDir. Wired into the bare readFile/writeFile/access
  wrappers and hasComposeFile(dir).
- resolveStackDir(stackName): throws INVALID_STACK_NAME if the name
  fails isValidStackName, then asserts the joined path is within base.
  Wired into getComposeFilePath, saveStackContent, envExists,
  getEnvContent, saveEnvContent, createStack, deleteStack,
  backupStackFiles, restoreStackFiles.

Routes still pre-validate at the request boundary; this is the
second line of defense and gives static analyzers a guard they can
trace through. The existing resolveSafeStackPath used by file-explorer
methods is unchanged (it adds symlink-escape detection on top).

The duplicate inline regex in createStack is removed because
resolveStackDir now performs the same check via isValidStackName.

2026-04-27 09:37:41 -04:00

scripts

fix(fleet): resolve getSenchoVersion crash in Docker containers (#396 )

2026-04-06 00:44:36 -04:00

src

refactor(backend): defensive path validation in FileSystemService (#802 )

2026-04-27 09:37:41 -04:00

.npmrc

chore(deps): upgrade major dependencies (ESLint 10, recharts 3, TS 6, Vite 8) (#130 )

2026-03-25 00:03:08 -04:00

eslint.config.mjs

feat: RBAC, atomic deployments, fleet backups, and licensing (Pro) (#185 )