Repository navigation
fix(web-remote): secure file previews and refresh changed directories - #129
Merged
Merged
Conversation
Use descriptor-relative no-follow access and bounded reads for file previews. Bind requests to a cwd snapshot and unique ID, then revalidate after I/O. Add filesystem race, browser response ordering and encrypted socket regressions. Prepare bilingual in-app release notes for v0.1.28-beta.6. CN: 修复网页文件预览的符号链接竞态越界与切换目录后内容错位，并准备 beta.6 更新说明
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Web Remote 文件预览在路径检查后重新打开文件，目录被并发替换为符号链接时可能越界；终端切换工作目录后，旧列表也可能显示新目录同名文件的内容。
改为基于目录句柄逐级打开、禁止跟随符号链接，并对文本和图片执行有界读取。浏览器请求绑定根目录和唯一请求编号，服务端在读取前后核验 cwd；目录变化时刷新列表，忽略过期响应。同步准备 v0.1.28-beta.6 的中英双语应用内更新说明。
验证：本地完整 Swift 测试 402/402、浏览器回归测试 28/28 通过；包含真实加密 WebSocket 的目录切换链路、并发符号链接替换、特殊文件拒绝和迟到响应测试。原审查中的越界复现脚本在修复后 10,000 次读取中未再复现。
git diff --check通过。