mlliuz eeea240857 fix: prevent path traversal via session_id in session_store ... load_session/save_session built the session file path directly from the caller-supplied session_id with no validation, so a value like '../../../tmp/secrets' (reachable from the 'load-session' CLI subcommand) could read or write JSON files outside the session directory. Add _validate_session_id() to reject anything outside [A-Za-z0-9_-] (path separators, '..', absolute/Windows paths) before the id is used to build a filename. Legitimate ids (uuid4 hex, 'session-<digits>-<n>') are unaffected. Adds SessionStorePathTraversalTests covering traversal rejection on both load and save plus a legitimate-id round-trip.		2026-06-11 12:56:41 +08:00
..
__init__.py	test: cover roadmap helper missing path	2026-06-03 19:31:45 +09:00
test_porting_workspace.py	Prevent plugin command aliases from becoming prompts	2026-05-15 10:07:47 +09:00
test_pre_push_hook_contract.py	Prevent pre-push contract drift (#3113)	2026-05-26 06:00:45 +08:00
test_roadmap_helpers.py	test: cover roadmap helper missing path	2026-06-03 19:31:45 +09:00
test_security_scope.py	fix: prevent path traversal via session_id in session_store	2026-06-11 12:56:41 +08:00