4 Commits

Author	SHA1	Message	Date
Ernest Hysa	cb6f6b65ea	fix(research): validate session_id to block path traversal ... Every research endpoint interpolates session_id into filesystem paths (Path('data/deep_research') / f'{session_id}.json') without checking for traversal sequences. A crafted ID like '../../data/auth' reaches arbitrary JSON files — readable via research_detail (which also leaks file paths in error messages), writable via research_archive, and deletable via research_delete. Add _validate_session_id() which rejects anything outside [a-zA-Z0-9-]{1,128}. Called before filesystem access in all 12 endpoints that accept a session_id path parameter.	2026-06-01 23:25:38 +01:00
pewdiepie-archdaemon	0888a3b3e6	Add native Windows compatibility layer	2026-06-01 15:09:47 +09:00
pewdiepie-archdaemon	b998c52dd0	Add Deep Research extraction controls	2026-06-01 14:55:33 +09:00
pewdiepie-archdaemon	e5c99a5eee	Odysseus v1.0	2026-05-31 23:58:26 +09:00