admin 106325de43 fix(R-1187 b): the import writes only through os.Root — never through a link that leaves the app's folder ...

Found by the automated security review of dfd0f8e. Red-proved. Commit only.

2026-10-26 20:28:04 +01:00

..

crypto.go

v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B)

2026-09-18 11:44:30 +02:00

estimate_volsize_test.go

R-203: the app and its backup look in the same directory — one resolver, every caller

2026-08-04 18:17:05 +02:00

estimate.go

.fab exclusion scoping: classes in the manual export (Task 4, v0.136.0)

2026-07-15 11:28:40 +02:00

export_additive_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

export.go

fix(R-1187 a,b,d,f,g): .fab — links carried and restored safely, FIFOs refused, owners kept, busy and bad-path refusals, postgis + ON_ERROR_STOP

2026-10-26 20:26:02 +01:00

fabexport_test.go

.fab exclusion scoping: classes in the manual export (Task 4, v0.136.0)

2026-07-15 11:28:40 +02:00

fabplan_test.go

v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B)

2026-09-18 11:44:30 +02:00

fabplan.go

fix(R-1187 a,b,d,f,g): .fab — links carried and restored safely, FIFOs refused, owners kept, busy and bad-path refusals, postgis + ON_ERROR_STOP

2026-10-26 20:26:02 +01:00

manifest.go

fix(CTRL-001): reject path traversal in .fab import manifest

2026-06-13 19:09:47 +02:00

provider.go

kept second-drive copies (D25: R-1175, R-1181, R-1179); .fab import keeps the family gate (R-1191); stale restore temp (R-1188 c); the overcommit sentence made true (R-1192); escrow before the floor (R-1176); unreleased

2026-10-21 15:46:10 +02:00

r1187_abdfg_test.go

fix(R-1187 b): the import writes only through os.Root — never through a link that leaves the app's folder

2026-10-26 20:28:04 +01:00

r1187c_test.go

R-1187 (c): refuse a .fab import over an installed app that is not running (it merged old and bundle data); R-1189 (d): the off-site proof + integrity check run after a catch-up; unreleased

2026-10-22 17:27:56 +02:00

r1253_busy_test.go

R-1253 (P2): an export that stops its app refuses while another operation (a restore) holds the app-stop marker — its Undo is never replaced. Commit only.

2026-10-24 20:29:59 +02:00

r1279_pull_first_test.go

D49 = A follow-ups: (A) the undo copy is released only after a stable start — 3 min of running, healthy, no restart, one rule for the first verdict and the late-start watch; a watch ends only for a restore begun after it; (B, R-1279) the .fab import downloads first with the restores' D48 helper, before it removes anything. Red-proved. Commit only.

2026-10-25 12:45:33 +01:00

restore.go

fix(R-1187 b): the import writes only through os.Root — never through a link that leaves the app's folder

2026-10-26 20:28:04 +01:00

roundtrip_test.go

kept second-drive copies (D25: R-1175, R-1181, R-1179); .fab import keeps the family gate (R-1191); stale restore temp (R-1188 c); the overcommit sentence made true (R-1192); escrow before the floor (R-1176); unreleased

2026-10-21 15:46:10 +02:00

traversal_regression_test.go

fix(CTRL-001): reject path traversal in .fab import manifest

2026-06-13 19:09:47 +02:00

validate.go

fix(CTRL-001): reject path traversal in .fab import manifest

2026-06-13 19:09:47 +02:00

volume_guard_test.go

controller: .fab volume legs stream via docker cp (fixes the containerized path-strand data loss, IA finding 1 HIGH) — zero shared paths both deployment shapes; export fails LOUD on any missing/empty claimed tar (no hollow bundles); import validates BEFORE it destroys (hollow bundle → app untouched); docker_run_volume_path_gate.py extinguishes the class (Tier-1/2 mounts documented host-visible)

2026-07-13 10:42:02 +02:00