4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
3 people	7144617d0e	Add decompression size limit in deserializeInner() (closes #24) (#29) ... Wrap zstd decompressor with `io.LimitReader` (256MB max) to prevent decompression bombs. Co-authored-by: clawbot <clawbot@openclaw> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: #29 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-02-09 01:45:55 +01:00
3 people	2efffd9da8	Specify and enforce path invariants (closes #26) (#31) ... Add `ValidatePath()` enforcing UTF-8, forward-slash, relative, no `..`, no empty segments. Applied in `AddFile` and `AddFileWithHash`. Proto comments document the rules. Co-authored-by: clawbot <clawbot@openclaw> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: #31 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-02-09 01:45:29 +01:00
clawbotandclawbot	ebaf2a65ca	Fix AddFile to verify actual bytes read matches declared size (closes #25) (#30) ... After reading file content, verify `totalRead == size` and return an error on mismatch. Co-authored-by: clawbot <clawbot@openclaw> Reviewed-on: #30 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-02-09 01:35:07 +01:00
clawbot	4b80c0067b	docs: replace TODO.md with design questions and implementation plan	2026-02-08 18:40:31 +01:00