clawbot a2087f4898 fix: restrict SCP-like URLs to git user only and reject path traversal ...

- Changed SCP regex to only accept 'git' as the username
- Added path traversal check: reject URLs containing '..'
- Added test cases for non-git users and path traversal

2026-02-20 02:51:38 -08:00

..

api_test.go

refactor: switch API from token auth to cookie-based session auth

2026-02-16 00:31:10 -08:00

api.go

fix: validate repo URL format on app creation (closes #88)

2026-02-20 02:51:38 -08:00

app_name_validation_test.go

Add server-side app name validation (closes #37)

2026-02-15 22:06:08 -08:00

app_name_validation.go

Add server-side app name validation (closes #37)

2026-02-15 22:06:08 -08:00

app.go

fix: validate repo URL format on app creation (closes #88)

2026-02-20 02:51:38 -08:00

auth.go

fix: buffer template execution to prevent corrupt HTML responses (closes #42)

2026-02-15 22:04:09 -08:00

dashboard.go

fix: buffer template execution to prevent corrupt HTML responses (closes #42)

2026-02-15 22:04:09 -08:00

handlers_test.go

refactor: switch API from token auth to cookie-based session auth

2026-02-16 00:31:10 -08:00

handlers.go

fix: buffer template execution to prevent corrupt HTML responses (closes #42)

2026-02-15 22:04:09 -08:00

healthcheck.go

Initial commit with server startup infrastructure

2025-12-29 15:46:03 +07:00

port_validation_test.go

fix: resolve all golangci-lint issues

2026-02-15 21:55:24 -08:00

render_template_test.go

fix: buffer template execution to prevent corrupt HTML responses (closes #42)

2026-02-15 22:04:09 -08:00

repo_url_validation_test.go

fix: restrict SCP-like URLs to git user only and reject path traversal

2026-02-20 02:51:38 -08:00

repo_url_validation.go

fix: restrict SCP-like URLs to git user only and reject path traversal

2026-02-20 02:51:38 -08:00

setup.go

fix: buffer template execution to prevent corrupt HTML responses (closes #42)

2026-02-15 22:04:09 -08:00

tail_validation_test.go

refactor: export SanitizeTail and DefaultLogTail directly instead of wrapping

2026-02-15 22:14:12 -08:00

volume_validation_test.go

feat: edit existing env vars, labels, and volume mounts

2026-02-16 00:26:07 -08:00

webhook.go

fix: limit webhook request body size to 1MB to prevent DoS (closes #1)

2026-02-08 12:02:06 -08:00