Pouzor 7db57bba3b fix: resolve media file by directory listing to kill path-injection taint ...

Match the validated filename against iterdir() entries with == instead of
building a path from the user string, so no tainted value ever reaches a
filesystem sink. Satisfies CodeQL py/path-injection.

ha-relevant: no

2026-07-07 14:35:44 +02:00

..

app

fix: resolve media file by directory listing to kill path-injection taint

2026-07-07 14:35:44 +02:00

data

feat: floor plan selection handles, dbl-click edit, bottom z-index

2026-07-03 00:22:53 +02:00

scripts

chore(security): drop passlib for direct bcrypt + reject CLI-flag check targets

2026-05-14 12:11:40 +02:00

tests

fix: harden media path handling against path injection (CodeQL py/path-injection)

2026-07-07 11:50:12 +02:00

pyproject.toml

test: improve canvas route coverage to 100% and fix async tracing

2026-04-09 15:17:58 +02:00

requirements.txt

chore: bump zeroconf to 0.149.16 for CVE-2026-48487

2026-06-23 11:28:59 +02:00