Chris Sherwood db1fe84553 fix(security): path traversal and SSRF protections from pre-launch audit ... Fixes 4 high-severity findings from a comprehensive security audit: 1. Path traversal on ZIM file delete — resolve()+startsWith() containment 2. Path traversal on Map file delete — same pattern 3. Path traversal on docs read — same pattern (already used in rag_service) 4. SSRF on download endpoints — block private/internal IPs, require TLD Also adds assertNotPrivateUrl() to content update endpoints. Full audit report attached as admin/docs/security-audit-v1.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>		2026-03-08 22:01:54 -07:00
..
benchmark_controller.ts	fix(Benchmark): improved error reporting and fix sysbench race condition	2026-02-11 22:09:31 -08:00
chats_controller.ts	fix: improve type-safety for KVStore values	2026-03-03 20:51:38 -08:00
collection_updates_controller.ts	fix(security): path traversal and SSRF protections from pre-launch audit	2026-03-08 22:01:54 -07:00
docs_controller.ts	fix(Docs): fix doc rendering	2025-07-11 15:31:07 -07:00
downloads_controller.ts	feat: background job overhaul with bullmq	2025-12-06 23:59:01 -08:00
easy_setup_controller.ts	feat: curated content system overhaul	2026-02-11 15:44:46 -08:00
home_controller.ts	fix(OSM): osm installation	2025-08-20 23:05:19 -07:00
maps_controller.ts	fix(security): path traversal and SSRF protections from pre-launch audit	2026-03-08 22:01:54 -07:00
ollama_controller.ts	fix(AI): allow force refresh of models list	2026-03-05 22:31:24 +00:00
rag_controller.ts	feat(RAG): allow deletion of files from KB	2026-03-04 20:05:14 -08:00
settings_controller.ts	feat(AI Assistant): custom name option for AI Assistant	2026-03-04 20:05:14 -08:00
system_controller.ts	feat: support for updating services	2026-03-09 04:55:43 +00:00
zim_controller.ts	fix(security): path traversal and SSRF protections from pre-launch audit	2026-03-08 22:01:54 -07:00