Skip to content

fix: symlink LFI containment, dedup collision, zero-vector guard, PDF page numbers, instruction cap, tar traversal - #140

Open
Shinzzyak wants to merge 1 commit into
StarTrail-org:mainfrom
Shinzzyak:fix/symlink-lfi-dedup-zerovector
Open

fix: symlink LFI containment, dedup collision, zero-vector guard, PDF page numbers, instruction cap, tar traversal#140
Shinzzyak wants to merge 1 commit into
StarTrail-org:mainfrom
Shinzzyak:fix/symlink-lfi-dedup-zerovector

Conversation

@Shinzzyak

Copy link
Copy Markdown

6 fixes (all verified, no regressions — 69 passed / 8 env-fails identical before/after):

  1. Symlink LFI (security): /tile endpoints followed symlinks outside workspace — now contained.
  2. Dedup collision: tile_index >= 10000 collided with structured-array keys — now collision-free.
  3. Zero-vector guard: embedding build with zero vectors no longer corrupts index.
  4. PDF sparse pages: page-numbered, no orphans.
  5. Instruction cap: nprobe/instruction count validated.
  6. Chrome tar extraction: path traversal guard on archive members.

Patch: 84+/19-.

… page numbers, instruction cap, tar traversal

- BUG-1: symlink LFI in /tile endpoints — contained to workspace
- BUG-2: tile_index dedup collision (>=10000)
- BUG-3: zero-vector embedding build guard
- BUG-4: PDF sparse pages now page-numbered (no orphans)
- BUG-5: instruction cap validation
- BUG-6: chrome tar extraction path traversal guard
@vercel

vercel Bot commented Aug 10, 2026

Copy link
Copy Markdown

Someone is attempting to deploy a commit to the andylizf's projects Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant