A a0f6b335a4 fix: harden upload_file path validation with strict allowlist regex across 10 clouds (#993) ... Replace fragile blocklist validation and printf '%q' escaping in upload_file() with strict allowlist regex [a-zA-Z0-9/_.~-]+ across all non-SSH cloud providers. For codesandbox, additionally migrate from shell command interpolation to SDK filesystem API via environment variables, eliminating the injection surface entirely. Affected clouds: codesandbox, daytona, e2b, fly, koyeb, modal, northflank, railway, render, sprite Fixes #989 Agent: security-auditor Co-authored-by: A <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-02-13 12:20:40 -08:00
..
common.sh	fix: harden upload_file path validation with strict allowlist regex across 10 clouds (#993)	2026-02-13 12:20:40 -08:00