wx44wx/pipecat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #4417 from pipecat-ai/mb/resolve-runner-filepath

Browse Source
This commit is contained in:
Mark Backman
2026-05-04 18:09:34 -04:00
committed by GitHub
parent b2b7e9ee6f e864d5778a
commit 7519c26ac5
5 changed files with 103 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
changelog/4417.security.md Normal file
View File

@@ -0,0 +1 @@
- Fixed a path traversal issue in the development runner's `/files/{filename:path}` download endpoint. Previously, when the runner was started with `--folder`, a request like `/files/..%2F..%2Fetc%2Fpasswd` could escape the configured folder because `%2F`-encoded separators bypassed Starlette's path normalisation. The endpoint now resolves the joined path and rejects any filename that escapes the allowed base with a 403, and also returns 404 (instead of an implicit `null` 200) when `--folder` is unset.