Dwi Siswanto 20cbf0bd73 refactor: use path-aware filesystem containment checks (#7420) ...

* feat(filepath): add IsPathWithinAnyDirectory func

Signed-off-by: Dwi Siswanto <git@dw1.io>

* refactor: use path-aware filesystem containment checks

Several filesystem trust boundaries relied on
lexical prefix checks to decide whether a path
fell under an allowed directory. That let sibling
paths be treated as if they were children of
trusted directories.

Replace those checks with canonical path
containment checks for helper payload loading,
template archive extraction, custom template
metadata, template path classification, and
headless screenshot output validation.

Signed-off-by: Dwi Siswanto <git@dw1.io>

* adding more tests

* fixing tests

* adding test

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>

2026-06-04 21:03:51 +05:30

..

authprovider

fixing flow with auth

2026-03-24 21:57:03 +01:00

catalog

refactor: use path-aware filesystem containment checks (#7420)

2026-06-04 21:03:51 +05:30

core

fix(workflow): propagate context to child & race steps

2026-05-08 02:59:49 +07:00

external/customtemplates

refactor: use path-aware filesystem containment checks (#7420)

2026-06-04 21:03:51 +05:30

fuzz

chore(deps): bump pdsec modules; switch to projectdiscovery/govaluate and aurora v4

2026-05-18 17:14:29 +03:00

input

refactor: native tests (#7307)

2026-04-15 05:27:07 +07:00

installer

refactor: use path-aware filesystem containment checks (#7420)

2026-06-04 21:03:51 +05:30

js

fix(js): probe SMBv1 support after SMB2 negotiation (#7430)

2026-05-30 09:16:06 +02:00

keys

fix missing template_url for pd signed templates when executed from custom path (#5644)

2024-09-19 18:58:20 +05:30

loader

merge

2024-03-15 00:01:09 +01:00

model

ci: integrate typos spell checker into CI workflow

2026-03-08 22:11:26 -04:00

operators

chore(deps): bump pdsec modules; switch to projectdiscovery/govaluate and aurora v4

2026-05-18 17:14:29 +03:00

output

chore(deps): bump pdsec modules; switch to projectdiscovery/govaluate and aurora v4

2026-05-18 17:14:29 +03:00

progress

build: bump all direct modules (#6290)

2025-07-01 00:40:44 +07:00

projectfile

refactor: use maps.Copy for cleaner map handling (#6283)

2025-07-12 02:50:47 +05:30

protocols

refactor: use path-aware filesystem containment checks (#7420)

2026-06-04 21:03:51 +05:30

reporting

refactor: use path-aware filesystem containment checks (#7420)

2026-06-04 21:03:51 +05:30

scan

lint

2025-11-18 22:20:17 +04:00

templates

chore(deps): bump pdsec modules; switch to projectdiscovery/govaluate and aurora v4

2026-05-18 17:14:29 +03:00

tmplexec

chore(deps): bump pdsec modules; switch to projectdiscovery/govaluate and aurora v4

2026-05-18 17:14:29 +03:00

types

refactor: use path-aware filesystem containment checks (#7420)

2026-06-04 21:03:51 +05:30

utils

refactor: use path-aware filesystem containment checks (#7420)

2026-06-04 21:03:51 +05:30

workflows

Revert "introducing workflow sequential mode"

2025-11-02 21:24:40 +07:00