From 404fc5c7fd9b1ed4780ba7a5510ba63fd7b6e9bd Mon Sep 17 00:00:00 2001 From: Rongsong Shen Date: Sat, 26 Sep 2026 07:40:04 +0000 Subject: [PATCH] chore(buglog): bug-1508 fixed (7723a4f4) Co-Authored-By: Claude Opus 5.5 (1M context) --- .wolf/buglog.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.wolf/buglog.json b/.wolf/buglog.json index 9cdc059c..899e286e 100644 --- a/.wolf/buglog.json +++ b/.wolf/buglog.json @@ -18082,9 +18082,9 @@ }, { "id": "bug-1508", - "status": "open", - "status_updated": "2026-09-24", - "status_note": "worker fetchfile opens any path: no job-ownership/path-traversal check (controller_connector.c)", + "status": "fixed", + "status_updated": "2026-09-26", + "status_note": "7723a4f4: worker fetchfile accepts only /job__task.out for the request's jobid (exact match), O_NOFOLLOW|O_NONBLOCK, regular single-link file. Also closed the REST route (user out_file=/etc/shadow).", "timestamp": "2026-08-08T00:00:00Z", "error_message": "No user report / no test failure -- discovered incidentally during doc-cleanup fact-check audit of src/docs/job_peek.md against current code.", "file": "src/worker/src/xcecd_worker.c (handle_fetchfile, jobs-peek fetchfile feature)",