陈志谦 4870e83aa7 fix(agent): prevent path traversal and SSRF in Browser URL file upload (#18711) ...

Hardens Browser component URL upload against path traversal (CWE-22) and SSRF (CWE-918). Fixed filename extraction to decode before basename() with strict validation. Replaced urllib with SSRF-safe fetch + manual redirect following. 15 tests pass.

---------

Co-authored-by: jindou <jindou@local>

2026-08-25 17:30:48 +08:00

..

__init__.py

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00

agent_with_tools.py

refa: resolve tenant model refs consistently (#16744)

2026-07-09 14:02:08 +08:00

base.py

fix(agent): preserve whitespace around message references (#18666)

2026-08-24 19:25:03 +08:00

begin.py

Add Go service/handler tests for API contract parity (#16905)

2026-07-20 20:02:41 +08:00

browser.py

fix(agent): prevent path traversal and SSRF in Browser URL file upload (#18711)

2026-08-25 17:30:48 +08:00

categorize.py

refa: resolve tenant model refs consistently (#16744)

2026-07-09 14:02:08 +08:00

data_operations.py

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00

docs_generator.py

fix(agent): preserve whitespace around message references (#18666)

2026-08-24 19:25:03 +08:00

excel_processor.py

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00

exit_loop.py

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00

fillup.py

fix: substitute UserFillUp tips placeholders literally to avoid re.error (#17321)

2026-08-25 12:39:01 +08:00

invoke.py

fix(agent): preserve whitespace around message references (#18666)

2026-08-24 19:25:03 +08:00

iteration.py

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00

iterationitem.py

fix(agent): defend against @ in var names at all template-split sites (#16469)

2026-07-03 19:26:27 +08:00

list_operations.py

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00

llm.py

Fix: restrict max_retries as non-negative integer (#18051)

2026-08-10 20:02:24 +08:00

loop.py

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00

loopitem.py

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00

message.py

fix: substitute Message variables literally to avoid re.error on regex escapes (#17319)

2026-08-25 12:46:03 +08:00

string_transform.py

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00

switch.py

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00

variable_aggregator.py

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00

variable_assigner.py

Refactor: reformat all code for lefthook using ruff and gofmt (#16585)

2026-07-03 12:53:39 +08:00