openclaw

Author	SHA1	Message	Date
Joao Lisboa	499a3e3227	style: fix biome formatting	2025-12-02 21:07:13 +00:00
Peter Steinberger	2cf134668c	fix(media): block symlink traversal	2025-12-02 18:37:15 +00:00
Joao Lisboa	b94b220156	Fix path traversal vulnerability in media server The /media/:id endpoint was vulnerable to path traversal attacks. Since this endpoint is exposed via Tailscale Funnel (unlike the WhatsApp webhook which requires Twilio signature validation), attackers could directly request paths like /media/%2e%2e%2fwarelay.json to access sensitive files in ~/.warelay/ (e.g. warelay.json), or even escape further to the user's home directory via multiple ../ sequences. Fix: validate resolved paths stay within the media directory. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-12-02 19:33:21 +01:00
Peter Steinberger	e5f677803f	chore: format to 2-space and bump changelog	2025-11-26 00:53:53 +01:00
Peter Steinberger	2ba56b82e7	Add media hosting and store tests	2025-11-25 12:30:43 +01:00