lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(buglog): bug-1508 fixed (7723a4f4)

Browse source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-09-26 07:40:04 +00:00
parent 7723a4f444
commit 404fc5c7fd
Signed by untrusted user: rshen
GPG key ID: 80533536B0EB651C
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
.wolf/buglog.json
View file

@ -18082,9 +18082,9 @@
}, },
{ {
"id": "bug-1508", "id": "bug-1508",
"status": "open", "status": "fixed",
"status_updated": "2026-09-24", "status_updated": "2026-09-26",
"status_note": "worker fetchfile opens any path: no job-ownership/path-traversal check (controller_connector.c)", "status_note": "7723a4f4: worker fetchfile accepts only <dir>/job_<jobid>_task<N>.out for the request's jobid (exact match), O_NOFOLLOW|O_NONBLOCK, regular single-link file. Also closed the REST route (user out_file=/etc/shadow).",
"timestamp": "2026-08-08T00:00:00Z", "timestamp": "2026-08-08T00:00:00Z",
"error_message": "No user report / no test failure -- discovered incidentally during doc-cleanup fact-check audit of src/docs/job_peek.md against current code.", "error_message": "No user report / no test failure -- discovered incidentally during doc-cleanup fact-check audit of src/docs/job_peek.md against current code.",
"file": "src/worker/src/xcecd_worker.c (handle_fetchfile, jobs-peek fetchfile feature)", "file": "src/worker/src/xcecd_worker.c (handle_fetchfile, jobs-peek fetchfile feature)",