github danielmiessler/Fabric v1.4.462

latest release: v1.4.463
4 hours ago

Changes

PR #2123 by ksylvan and OdinKral: fix: block path traversal in pattern name lookup

  • Security Fix: Blocked path traversal attacks in pattern name lookup (closes #2094) — pattern names containing .. could previously escape the patterns directory and read arbitrary files via filepath.Join; a guard has been added at the top of getFromDB, an i18n key pattern_invalid_name has been added to all 11 locale files, and test cases now cover all common traversal variants.
  • New translations for the "invalid pattern" user-facing string.

Don't miss a new Fabric release

NewReleases is sending notifications on new releases.