Sebastion 7778d8bb63 fix: prevent path traversal in backup importer (CWE-22) (#7681) ...

* fix: prevent path traversal in backup importer (CWE-22)

Validate that all file write targets resolve within their expected
base directories before writing. This prevents crafted backup ZIP
files from writing to arbitrary filesystem locations via malicious
path values in attachment records, media file paths, or directory
entries.

* fix: use Path.is_relative_to for robust path containment check

* fix: add explicit strict=False to Path.resolve() calls

* style: format backup importer

---------

Co-authored-by: 邹永赫 <1259085392@qq.com>

2026-04-21 22:52:34 +08:00

..

__init__.py

feat: supports data backup (#4105)

2025-12-26 15:47:50 +08:00

constants.py

fix: add ChatUIProject & SessionProjectRelation to shared constants & test cases (#7414)

2026-04-08 11:35:59 +08:00

exporter.py

chore: auto ann fix by ruff (#4903)

2026-02-09 00:22:24 +08:00

importer.py

fix: prevent path traversal in backup importer (CWE-22) (#7681)

2026-04-21 22:52:34 +08:00