diff options
| author | Paul Buetow <paul@buetow.org> | 2026-05-13 10:27:15 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-05-13 10:27:15 +0300 |
| commit | a21c653c9939ac82b181709dc745f017fb3b8a8a (patch) | |
| tree | 9aac7254da11fddb66895bc7b141ba8618e5d69f /internal/runtime/runtime.go | |
| parent | 62104fbcabf811b6cd31db15f0f72db1f9d3c6e6 (diff) | |
fix: prevent path traversal in TUI stream CSV export filename
User-supplied filenames are now sanitised through filepath.Base before
being joined with exportDir, so inputs like "../../etc/passwd" can no
longer write files outside the intended export directory. Pure directory
references ("..") are rejected outright. Two new tests cover both the
unit-level sanitisation and the end-to-end exportRowsToCSV path.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'internal/runtime/runtime.go')
0 files changed, 0 insertions, 0 deletions