sneak
f2ff2e3e19
Check / check (pull_request) Skipped
gosec flagged G703 (path traversal via taint analysis) on the log download handler because the served path derives from a URL parameter. Open the log file through an os.Root confined to the deploy log directory instead of passing the path to http.ServeFile; Root.Open rejects any path that escapes the root, so traversal attempts return 404. Serve the opened file with http.ServeContent. Adds GetLogDir on the deploy service and unit tests covering a legitimate download and a traversal-shaped app name. Model: opus-4-8