A ffb4cbeb11 fix(security): prevent path traversal in uploadFile/downloadFile across all cloud providers (#2844) ... Check for ".." path traversal in the raw input BEFORE normalize() strips it, fixing CWE-22 where crafted paths like "/tmp/../../etc/passwd" normalized to "/etc/passwd" and bypassed the post-normalize ".." check. Extracts a shared validateRemotePath() into shared/ssh.ts and replaces the duplicated inline validation in all 5 providers (DigitalOcean, Hetzner, GCP, AWS, Sprite) plus agent-setup.ts. Fixes #2835 Agent: complexity-hunter Co-authored-by: B <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>		2026-03-20 16:48:58 -07:00
..
cli	fix(security): prevent path traversal in uploadFile/downloadFile across all cloud providers (#2844)	2026-03-20 16:48:58 -07:00
shared	feat: enforce CI coverage thresholds + colocate billing guidance (#2811)	2026-03-19 22:52:45 -07:00