teknium1 1cb2311bad fix(security): block path traversal in skill_view file_path (fixes #220) ... skill_view accepted arbitrary file_path values like '../../.env' and would read files outside the skill directory, exposing API keys and other sensitive data. Added two layers of defense: 1. Reject paths with '..' components (fast, catches obvious traversal) 2. resolve() containment check with trailing '/' to prevent prefix collisions (catches symlinks and edge cases) Fix approach from PR #242 (@Bartok9). Vulnerability reported by @Farukest (#220, PR #221). Tests rewritten to properly mock SKILLS_DIR. Closes #220		2026-03-02 02:00:09 -08:00
..
__init__.py	test: reorganize test structure and add missing unit tests	2026-02-26 03:20:08 +03:00
test_approval.py	test: add regression tests for recursive delete false positive fix	2026-02-26 16:40:44 +03:00
test_clarify_tool.py	test(tools): add unit tests for clarify_tool.py	2026-02-27 03:29:26 -05:00
test_code_execution.py	test: reorganize test structure and add missing unit tests	2026-02-26 03:20:08 +03:00
test_cron_prompt_injection.py	fix: cron prompt injection scanner bypass for multi-word variants	2026-02-26 13:55:54 +03:00
test_cronjob_tools.py	test: add unit tests for 8 modules (batch 2)	2026-02-26 13:54:20 +03:00
test_debug_helpers.py	test: add unit tests for 8 untested modules (batch 3) (#191)	2026-03-01 05:28:12 -08:00
test_delegate.py	Merge remote-tracking branch 'origin/main' into codex/align-codex-provider-conventions-mainrepo	2026-02-26 10:56:29 -08:00
test_file_operations.py	test: remove /etc platform-conditional tests from file_operations	2026-02-26 13:43:30 +03:00
test_file_tools.py	test: enhance session source tests and add validation for chat types	2026-02-26 00:53:57 -08:00
test_file_tools_live.py	feat(tests): add live integration tests for file operations and shell noise filtering	2026-02-28 22:57:58 -08:00
test_fuzzy_match.py	test: reorganize test structure and add missing unit tests	2026-02-26 03:20:08 +03:00
test_interrupt.py	test: reorganize test structure and add missing unit tests	2026-02-26 03:20:08 +03:00
test_memory_tool.py	test: add unit tests for 8 untested modules	2026-02-26 13:27:58 +03:00
test_patch_parser.py	test: reorganize test structure and add missing unit tests	2026-02-26 03:20:08 +03:00
test_process_registry.py	test: add unit tests for 8 modules (batch 2)	2026-02-26 13:54:20 +03:00
test_registry.py	test: reorganize test structure and add missing unit tests	2026-02-26 03:20:08 +03:00
test_session_search.py	test: add unit tests for 8 modules (batch 2)	2026-02-26 13:54:20 +03:00
test_skill_view_traversal.py	fix(security): block path traversal in skill_view file_path (fixes #220)	2026-03-02 02:00:09 -08:00
test_skills_guard.py	test: add unit tests for 8 untested modules (batch 3) (#191)	2026-03-01 05:28:12 -08:00
test_skills_sync.py	test: add unit tests for 8 untested modules (batch 3) (#191)	2026-03-01 05:28:12 -08:00
test_todo_tool.py	test: reorganize test structure and add missing unit tests	2026-02-26 03:20:08 +03:00
test_write_deny.py	fix: resolve symlink bypass in write deny list on macOS	2026-02-26 13:30:55 +03:00