Mortdecai 65622501fe fix: block path traversal in static handler ...

The LAN-bound HTTP server joined the raw URL path onto the project dir,
so /../../.ssh/id_ed25519 (and %2e%2e variants) served any file the
user could read. Resolve and require the path stay inside the project.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-09-28 16:28:36 -04:00

..

workbench

fix: block path traversal in static handler

2026-09-28 16:28:36 -04:00