Glucksberg 34e2425b4d fix(security): restrict MEDIA path extraction to prevent LFI (#4930) ...

* fix(security): restrict inbound media staging to media directory

* docs: update MEDIA path guidance for security restrictions

- Update agent hint to warn against absolute/~ paths
- Update docs example to use https:// instead of /tmp/

---------

Co-authored-by: Evan Otero <evanotero@google.com>

2026-01-31 10:55:37 -08:00

..

reply

fix(security): restrict MEDIA path extraction to prevent LFI (#4930)

2026-01-31 10:55:37 -08:00

chunk.test.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

chunk.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

command-auth.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

command-control.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

command-detection.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

commands-args.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

commands-registry.data.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

commands-registry.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

commands-registry.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

commands-registry.types.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

dispatch.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

envelope.test.ts

fix: default envelope timestamps to local

2026-01-22 04:10:06 +00:00

envelope.ts

refactor: use compact formatZonedTimestamp for injection

2026-01-31 09:47:27 -06:00

group-activation.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

heartbeat.test.ts

feat(heartbeat): skip API calls when HEARTBEAT.md is effectively empty (#1535)

2026-01-24 04:19:01 +00:00

heartbeat.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

inbound-debounce.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

inbound.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

media-note.test.ts

refactor: tighten media diagnostics

2026-01-17 07:27:38 +00:00

media-note.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

model.test.ts

Fix models command (#1753)

2026-01-25 10:02:12 +00:00

model.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

reply.block-streaming.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.directive.directive-behavior.accepts-thinking-xhigh-codex-models.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.directive.directive-behavior.applies-inline-reasoning-mixed-messages-acks-immediately.e2e.test.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

reply.directive.directive-behavior.defaults-think-low-reasoning-capable-models-no.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.directive.directive-behavior.ignores-inline-model-uses-default-model.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.directive.directive-behavior.lists-allowlisted-models-model-list.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.directive.directive-behavior.prefers-alias-matches-fuzzy-selection-is-ambiguous.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.directive.directive-behavior.requires-per-agent-allowlist-addition-global.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.directive.directive-behavior.returns-status-alongside-directive-only-acks.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.directive.directive-behavior.shows-current-elevated-level-as-off-after.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.directive.directive-behavior.shows-current-verbose-level-verbose-has-no.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.directive.directive-behavior.supports-fuzzy-model-matches-model-directive.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.directive.directive-behavior.updates-tool-verbose-during-flight-run-toggle.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.directive.parse.test.ts

feat: add elevated ask/full modes

2026-01-22 05:41:11 +00:00

reply.heartbeat-typing.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.media-note.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.queue.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.raw-body.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.group-intro-prompts.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.allows-activation-from-allowfrom-groups.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.allows-approved-sender-toggle-elevated-mode.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.allows-elevated-off-groups-without-mention.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.filters-usage-summary-current-model-provider.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.handles-inline-commands-strips-it-before-agent.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.ignores-inline-elevated-directive-unapproved-sender.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.includes-error-cause-embedded-agent-throws.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.keeps-inline-status-unauthorized-senders.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.reports-active-auth-profile-key-snippet-status.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.runs-compact-as-gated-command.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.runs-greeting-prompt-bare-reset.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.shows-endpoint-default-model-status-not-configured.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.shows-quick-model-picker-grouped-by-model.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.stages-inbound-media-into-sandbox-workspace.security.test.ts

fix(security): restrict MEDIA path extraction to prevent LFI (#4930)

2026-01-31 10:55:37 -08:00

reply.triggers.trigger-handling.stages-inbound-media-into-sandbox-workspace.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.triggers.trigger-handling.targets-active-session-native-stop.e2e.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

reply.ts

feat: add /exec session overrides

2026-01-18 06:12:54 +00:00

send-policy.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

skill-commands.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

skill-commands.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

status.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

status.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

templating.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

thinking.test.ts

fix: align ZAI thinking toggles

2026-01-16 22:26:43 +00:00

thinking.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

tokens.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

tool-meta.test.ts

fix: improve tool summaries

2026-01-23 01:00:24 +00:00

tool-meta.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

types.ts

feat: Add Line plugin (#1630)

2026-01-25 12:22:36 +00:00