felhom-controller

Files

T

admin c20ff56e4a fix(CTRL-001): reject path traversal in .fab import manifest

manifest.AppName / HDDSubdirs / VolumeNames are attacker-controlled JSON inside
an imported .fab and reach filepath.Join+MkdirAll/extractTar with a trusted base
(restore.go:339/606/678). UnmarshalManifest did zero validation, so '../..' in
any of them escaped the stacks / HDD destination dir.

- New appexport.ValidateSegment + validateManifestPaths; UnmarshalManifest now
  fails the parse on a traversal segment (the chokepoint).
- Defence-in-depth ValidateSegment guards at the HDD-subdir and volume-name join
  loops in restore.go.
- ConfigFiles deliberately NOT validated (holds dotfiles like .felhom.yml; never
  used in a restore join).
- Permanent regression test (was the deep-sweep failing audit test) now asserts
  rejection of traversal + acceptance of legit names.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-13 19:09:47 +02:00

crypto.go

feat: comprehensive debug logging across all controller modules

2026-02-26 18:14:43 +01:00

estimate.go

v0.51.0: offsite-backup UI (felhom-pbs DR) + Model-A double-nest fix

2026-06-12 20:26:52 +02:00

export.go

refactor: extract app-data-backup into internal/appbackup (no behaviour change)

2026-06-08 11:01:39 +02:00

manifest.go

fix(CTRL-001): reject path traversal in .fab import manifest