mirror of
https://github.com/got-feedBack/feedBack.git
synced 2026-07-22 21:01:40 +00:00
0a45e89777
A song library mounted through a directory JUNCTION/symlink subfolder (a library shared across app installs; the desktop app's own mounts) had broken album art and couldn't load: the scanner's rglob follows the junction and indexes the songs, but _resolve_dlc_path (via safe_join's .resolve()) followed the junction to its real target, saw it outside DLC_DIR, and rejected every song reached through it → 403 on /art, 404 on /art/candidates, broken covers. - _resolve_dlc_path now uses LEXICAL containment (os.path.normpath, no symlink following) so an in-library junction is allowed, while `..` traversal and absolute paths are still rejected (the traversal tests pin this). - safe_join is left STRICT (.resolve()-based) — it is the zip-slip / plugin- asset / avatar guard, where following a symlink out IS the defense — but gains an explicit NUL guard (on Python 3.13/Windows resolve() no longer raises on an embedded NUL, so the byte was leaking through; strictly-more- rejection, no effect on the zip-slip contract). Tests: test_dlc_junction (junction allowed; `..`/absolute/NUL rejected; the safe_join-stays-strict contrast). Existing traversal/safepath/art-candidates suites stay green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| audio.py | ||
| diagnostics_bundle.py | ||
| diagnostics_hardware.py | ||
| diagnostics_redact.py | ||
| drums.py | ||
| env_compat.py | ||
| gp2midi.py | ||
| gp2notation.py | ||
| gp2rs_gpx.py | ||
| gp2rs.py | ||
| gp8_audio_sync.py | ||
| gp_autosync.py | ||
| jsonc.py | ||
| logging_setup.py | ||
| loosefolder.py | ||
| lyrics_transcribe.py | ||
| mb_match.py | ||
| midi_import.py | ||
| notation_lift.py | ||
| notation.py | ||
| progression.py | ||
| safepath.py | ||
| scan_worker.py | ||
| sloppak.py | ||
| song_score.py | ||
| song.py | ||
| songmeta.py | ||
| tailwind_rebuild.py | ||
| tones.py | ||
| tunings.py | ||
| vocal_pitch.py | ||
| wem_decode.py | ||
| xp.py | ||