langgenius/dify-plugin-daemon
1
0
Fork 0
mirror of https://github.com/langgenius/dify-plugin-daemon.git synced 2026-07-21 17:25:23 -04:00
Code Issues 111 Packages Projects Releases 10 Wiki Activity

[PR #205] [MERGED] fix(persistence): correct path traversal checks in tests and implementation #369

New Issue
Closed
opened 2026-02-16 01:15:45 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 01:15:45 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/langgenius/dify-plugin-daemon/pull/205
Author: @Yeuoly
Created: 4/15/2025
Status: ✅ Merged
Merged: 4/15/2025
Merged by: @Yeuoly

Base: main ← Head: fix/path-travel

📝 Commits (3)

  • 8ea9492 rebase
  • 4fe9f4a fix(persistence): correct path traversal checks in tests and implementation
  • 2501cb8 refactor(tests): simplify persistence tests using testify assertions

📊 Changes

3 files changed (+115 additions, -29 deletions)

View changed files

📝 internal/core/persistence/persistence.go (+19 -1)
📝 internal/core/persistence/persistence_test.go (+95 -28)
📝 internal/core/persistence/wrapper.go (+1 -0)

📄 Description

fix(persistence): correct path traversal checks in tests and implementation

- Updated test cases to expect no errors for valid paths with double slashes and mixed traversal.
- Enhanced the `checkPathTraversal` method to clean the key using `path.Clean` to prevent path traversal vulnerabilities.
- Removed redundant checks in the `getFilePath`, `Save`, `Load`, and `Delete` methods, simplifying the code while maintaining security.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/langgenius/dify-plugin-daemon/pull/205 **Author:** [@Yeuoly](https://github.com/Yeuoly) **Created:** 4/15/2025 **Status:** ✅ Merged **Merged:** 4/15/2025 **Merged by:** [@Yeuoly](https://github.com/Yeuoly) **Base:** `main` ← **Head:** `fix/path-travel` --- ### 📝 Commits (3) - [`8ea9492`](https://github.com/langgenius/dify-plugin-daemon/commit/8ea949295934c959c99f0881a23eaacb53cc5420) rebase - [`4fe9f4a`](https://github.com/langgenius/dify-plugin-daemon/commit/4fe9f4ae21c003af1b9804dc8494bb07b0ede7eb) fix(persistence): correct path traversal checks in tests and implementation - [`2501cb8`](https://github.com/langgenius/dify-plugin-daemon/commit/2501cb84b2a6f434d997b602a9948a046fbcc669) refactor(tests): simplify persistence tests using testify assertions ### 📊 Changes **3 files changed** (+115 additions, -29 deletions) <details> <summary>View changed files</summary> 📝 `internal/core/persistence/persistence.go` (+19 -1) 📝 `internal/core/persistence/persistence_test.go` (+95 -28) 📝 `internal/core/persistence/wrapper.go` (+1 -0) </details> ### 📄 Description fix(persistence): correct path traversal checks in tests and implementation - Updated test cases to expect no errors for valid paths with double slashes and mixed traversal. - Enhanced the `checkPathTraversal` method to clean the key using `path.Clean` to prevent path traversal vulnerabilities. - Removed redundant checks in the `getFilePath`, `Save`, `Load`, and `Delete` methods, simplifying the code while maintaining security. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-16 01:15:45 -05:00
yindo closed this issue 2026-02-16 01:15:45 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Windows
bug
cmd
documentation
enhancement
go
good first issue
plugin-daemon
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify-plugin-daemon#369
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?