molecule-ai[bot] 38e9eba59a fix(P0): CWE-22 path traversal in copyFilesToContainer + ContextMenu test ... Issue #1434 — CWE-22 Path Traversal Regression: PR #1280 (dc218212) correctly used cleaned path in tar header. PR #1363 (e9615af) regressed to using uncleaned `name`. Fix: use `clean` in filepath.Join AND add defence-in-depth escape check. Issue #1422 — ContextMenu Test Regression: PR #1340 expanded pendingDelete store type to include `children:[]`. Test assertion missing the field — add `children:[]` to match. Note: ssrf.go created (shared isSafeURL/isPrivateOrMetadataIP) to prepare for the handler-split refactor fix — current branch has no build error, but the shared file will prevent regression when PR #1363 is merged. isSafeURL/isPrivateOrMetadataIP retained in both files for now to avoid breaking callers while the split is finalized. Co-authored-by: Molecule AI Core-BE <core-be@agents.moleculesai.app> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-04-21 16:56:47 +00:00
..
cmd/server	fix(go): replace $1 literal with resp.Body.Close() in 7 files (#1247)	2026-04-21 03:18:21 +00:00
internal	fix(P0): CWE-22 path traversal in copyFilesToContainer + ContextMenu test	2026-04-21 16:56:47 +00:00
migrations	fix(F1089): log panic-recovery UPDATE errors in scheduler (#1233)	2026-04-21 02:45:25 +00:00
pkg/provisionhook	fix(docker): fix plugin go.mod replace for TokenProvider interface (#960)	2026-04-20 13:42:53 -07:00
.ci-force	chore: force Platform(Go) CI run on main — validate go vet clean	2026-04-21 15:43:19 +00:00
.gitignore	feat(ws-server): pull env from CP on startup	2026-04-19 02:41:15 -07:00
Dockerfile	fix(security): add USER directive before ENTRYPOINT in all tenant images (#1155)	2026-04-20 23:51:33 +00:00
Dockerfile.tenant	fix(tenant-image): remove node user so canvas uid 1000 can be created	2026-04-21 08:57:47 -07:00
entrypoint-tenant.sh	fix(security): add USER directive before ENTRYPOINT in all tenant images (#1155)	2026-04-20 23:51:33 +00:00
go.mod	chore: open-source restructure — rename dirs, remove internal files, scrub secrets	2026-04-18 00:24:44 -07:00
go.sum	chore: open-source restructure — rename dirs, remove internal files, scrub secrets	2026-04-18 00:24:44 -07:00