yuanyeex
/
openclaw
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
openclaw/src
History
Glucksberg 34e2425b4d
fix(security): restrict MEDIA path extraction to prevent LFI (#4930) 
* fix(security): restrict inbound media staging to media directory

* docs: update MEDIA path guidance for security restrictions

- Update agent hint to warn against absolute/~ paths
- Update docs example to use https:// instead of /tmp/

---------

Co-authored-by: Evan Otero <evanotero@google.com>
 		2026-01-31 10:55:37 -08:00
..
acp chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
agents fix: stabilize partial streaming filters 2026-01-31 22:46:19 +05:30
auto-reply fix(security): restrict MEDIA path extraction to prevent LFI (#4930) 2026-01-31 10:55:37 -08:00
browser chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
canvas-host chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
channels chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
cli revert: Switch back to `tsc` for compiling. 2026-01-31 18:31:49 +09:00
commands feat: add MiniMax OAuth plugin (#4521) (thanks @Maosghoul) 2026-01-31 12:42:45 +01:00
compat refactor: rename to openclaw 2026-01-30 03:16:21 +01:00
config feat: add MiniMax OAuth plugin (#4521) (thanks @Maosghoul) 2026-01-31 12:42:45 +01:00
cron chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
daemon revert: Switch back to `tsc` for compiling. 2026-01-31 18:31:49 +09:00
discord chore: Emit TypeScript declaration files so that we can type-check the extensions folder soon. 2026-01-31 21:57:21 +09:00
docs bugfix:The Mintlify navbar (logo + search bar with ⌘K) scrolls away w… (#2445) 2026-01-26 17:39:10 -08:00
gateway Gateway: inject timestamps into agent/chat.send (#3705) (thanks @conroywhitney, @CashWilliams) 2026-01-31 09:47:27 -06:00
hooks chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
imessage chore: Oops, "long" is actually used + fix TypeScript error. 2026-01-31 17:12:28 +09:00
infra revert: Switch back to `tsc` for compiling. 2026-01-31 18:31:49 +09:00
line chore: Emit TypeScript declaration files so that we can type-check the extensions folder soon. 2026-01-31 21:57:21 +09:00
link-understanding chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
logging chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
macos chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
markdown chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
media chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
media-understanding chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
memory chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
node-host chore: Fix TypeScript errors 1/n. 2026-01-31 16:38:03 +09:00
pairing chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
plugin-sdk refactor: rename to openclaw 2026-01-30 03:16:21 +01:00
plugins revert: Switch back to `tsc` for compiling. 2026-01-31 18:31:49 +09:00
process chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
providers chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
routing chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
scripts refactor: rename to openclaw 2026-01-30 03:16:21 +01:00
security chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
sessions chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
shared/text chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
signal chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
slack chore: Emit TypeScript declaration files so that we can type-check the extensions folder soon. 2026-01-31 21:57:21 +09:00
telegram fix: harden telegram streaming state 2026-01-31 22:46:19 +05:30
terminal chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
test-helpers refactor: rename to openclaw 2026-01-30 03:16:21 +01:00
test-utils chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
tts chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
tui chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
types chore: Enable more lint rules, disable some that trigger a lot. Will clean up later. 2026-01-31 16:04:04 +09:00
utils chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
web chore: Emit TypeScript declaration files so that we can type-check the extensions folder soon. 2026-01-31 21:57:21 +09:00
whatsapp chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
wizard fix: restore tsc build and plugin install tests 2026-01-31 07:54:15 +00:00
channel-web.barrel.test.ts refactor!: rename chat providers to channels 2026-01-13 08:40:39 +00:00
channel-web.ts refactor!: rename chat providers to channels 2026-01-13 08:40:39 +00:00
docker-setup.test.ts refactor: rename to openclaw 2026-01-30 03:16:21 +01:00
entry.ts chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
git-hooks.test.ts chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
globals.test.ts chore: format to 2-space and bump changelog 2025-11-26 00:53:53 +01:00
globals.ts chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
index.test.ts chore: migrate to oxlint and oxfmt 2026-01-14 15:02:19 +00:00
index.ts refactor: rename to openclaw 2026-01-30 03:16:21 +01:00
logger.test.ts refactor: rename to openclaw 2026-01-30 03:16:21 +01:00
logger.ts chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
logging.ts fix: unblock bundled plugin load 2026-01-18 19:34:21 +00:00
polls.test.ts chore: migrate to oxlint and oxfmt 2026-01-14 15:02:19 +00:00
polls.ts chore: migrate to oxlint and oxfmt 2026-01-14 15:02:19 +00:00
postinstall-patcher.test.ts refactor: rename to openclaw 2026-01-30 03:16:21 +01:00
runtime.ts perf: speed up memory batch polling 2026-01-18 03:55:14 +00:00
utils.test.ts chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
utils.ts chore: Enable "curly" rule to avoid single-statement if confusion/errors. 2026-01-31 16:19:20 +09:00
version.ts refactor: rename to openclaw 2026-01-30 03:16:21 +01:00