From b7c7c254b0075ceab1d461b4bc6d7fed2eaea621 Mon Sep 17 00:00:00 2001 From: zumayaaustin Date: Wed, 8 Jul 2026 23:13:23 +0000 Subject: [PATCH] Tighten skill name allowlist to exclude '.' (path traversal) Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- server.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server.py b/server.py index fe57005..a76e4f5 100644 --- a/server.py +++ b/server.py @@ -133,7 +133,7 @@ def load_json_file(path: Path, default=_MISSING): except (json.JSONDecodeError, OSError, UnicodeDecodeError) as e: raise HTTPException(500, f"Failed to read {path.name}: {e}") -SKILL_NAME_RE = re.compile(r"^[A-Za-z0-9._-]+$") +SKILL_NAME_RE = re.compile(r"^[A-Za-z0-9_-]+$") def skill_dir(name: str) -> Path: """Resolve a user-supplied skill name to its directory, rejecting path traversal."""