nanobot

594 Commits 1 Branch 1 Tag

2 Commits

Author	SHA1	Message	Date
andienguyen-ecoligo	ef96619039	fix(slack): add exception handling to socket listener _handle_message() in _on_socket_request() had no try/except. If it throws (bus full, permission error, etc.), the exception propagates up and crashes the Socket Mode event loop, causing missed messages. Other channels like Telegram already have explicit error handlers. Fixes #895	2026-02-21 12:34:50 -05:00
andienguyen-ecoligo	5c9cb3a208	fix(security): prevent path traversal bypass via startswith check `startswith` string comparison allows bypassing directory restrictions. For example, `/home/user/workspace_evil` passes the check against `/home/user/workspace` because the string starts with the allowed path. Replace with `Path.relative_to()` which correctly validates that the resolved path is actually inside the allowed directory tree. Fixes #888	2026-02-21 12:34:14 -05:00

Author

SHA1

Message

Date

andienguyen-ecoligo

ef96619039

fix(slack): add exception handling to socket listener

_handle_message() in _on_socket_request() had no try/except. If it
throws (bus full, permission error, etc.), the exception propagates up
and crashes the Socket Mode event loop, causing missed messages.

Other channels like Telegram already have explicit error handlers.

Fixes #895

2026-02-21 12:34:50 -05:00

andienguyen-ecoligo

5c9cb3a208

fix(security): prevent path traversal bypass via startswith check

`startswith` string comparison allows bypassing directory restrictions.
For example, `/home/user/workspace_evil` passes the check against
`/home/user/workspace` because the string starts with the allowed path.

Replace with `Path.relative_to()` which correctly validates that the
resolved path is actually inside the allowed directory tree.

Fixes #888

2026-02-21 12:34:14 -05:00