diff options
| author | Stefan Boberg <[email protected]> | 2026-03-20 19:58:36 +0100 |
|---|---|---|
| committer | Stefan Boberg <[email protected]> | 2026-03-20 19:58:36 +0100 |
| commit | 82620db8cfc41f80b4f0dde7d9eee92e6eb7aa0d (patch) | |
| tree | a33571101755bf390ec20f10c9dcdab7d0863e79 /src/zenhttp/testing/httptest.cpp | |
| parent | Add .clangd config to strip unsupported MSVC flags (diff) | |
| download | zen-sb/compute-auth.tar.xz zen-sb/compute-auth.zip | |
Reject local file references in package parsing by defaultsb/compute-auth
- Add ParseFlags enum with kAllowLocalReferences opt-in flag
- Default to rejecting local refs in ParsePackageMessage and
CbPackageReader, protecting against path traversal from untrusted
remote clients
- Add HttpService::AcceptsLocalFileReferences() virtual (default false)
- Override to true in HttpStructuredCacheService and HttpProjectService,
which need local refs for the local UE cooker optimization
- Both server ingest paths now require IsLocalMachineRequest() AND
AcceptsLocalFileReferences() before allowing local refs
Diffstat (limited to 'src/zenhttp/testing/httptest.cpp')
0 files changed, 0 insertions, 0 deletions