fix(tools): reject path traversal in Drive, BigQuery, Box, Supabase and Contacts ids by waleedlatif1 · Pull Request #7269 · simstudioai/sim

fix(github): reject path-traversal values in interpolated URL segments

waleedlatif1

committed

d36e6c8

fix(github): stop safeUrlPath trimming real filename whitespace

waleedlatif1

committed

64273cf

fix(github): permit a whitespace-only path component

waleedlatif1

committed

515b951

fix(github): refuse a padded identifier on state-changing requests

waleedlatif1

committed

d2c74d7

docs(github): record why the strict guards stop at writes

waleedlatif1

committed

0c5108e

fix(github): reject a backslash in safeEncodedUrlPathSegment

waleedlatif1

committed

ccbf0d2

fix(tools): reject path traversal in Drive, BigQuery, Box, Supabase and Contacts ids

waleedlatif1

committed

2ce0e27

test(tools): stop the coverage pin from being blind to non-function URLs

waleedlatif1

committed

8f59a57

test(tools): catch balanced traversal and pin the full single-segment shape

waleedlatif1

committed

d6b4e6f

fix(bigquery): send one project id in both the URL and the request body

waleedlatif1

committed

850f069

test(bigquery): drop dotted ids from the per-parameter allowlist

waleedlatif1

committed

6d76111

docs(box_sign): describe the defect in past tense, not the fixed code

waleedlatif1

committed

158e3dd

fix(bigquery): derive body identifiers from the path guard, not a bare trim

waleedlatif1

committed

7ba83ee

test(tools): probe sibling branch literals in pairs, not just singly

waleedlatif1

committed

b11e847

fix(bigquery): refuse a padded projectId instead of silently resolving it

waleedlatif1

committed

56ac387

fix(supabase): report storage path-guard failures as 400, not 500

waleedlatif1

committed

660bd58

fix(box_sign): refuse a padded signRequestId instead of silently resolving it

waleedlatif1

committed

e69be67

test(tools): stop the preserves-whitespace branch swallowing a rejection

waleedlatif1

committed

df3082e

test(tools): fail when a guard rejects a value it must render inert

waleedlatif1

committed

fa93d21

fix(tools): stop guard errors echoing the rejected value, and close the last swallow

waleedlatif1

committed

8e6e18c

test(supabase): pin both derived parameter groups, not just their total

waleedlatif1

committed

49c802f

test(tools): bound the names-the-parameter match to whole words

waleedlatif1

committed

c39f572

test(bigquery): assert the body project id unconditionally

waleedlatif1

committed

b9f6367

test(supabase): track #7262 permitting a whitespace-only path component

waleedlatif1

committed

b43bbe3

test(tools): single discovery sweep, and record why the assertions are exact

waleedlatif1

committed

e572bba

refactor(tools): use #7262's strictUrlPathSegment and delete the local copy

waleedlatif1

committed

345ef7f

test(bigquery): compare URL and body to each other, not to two literals

waleedlatif1

committed

193d084

fix(tools): stop applying the strict guard to read routes

waleedlatif1

committed

c43998b

test(bigquery): complete the exemption list and pin it

waleedlatif1

committed

30f1579

fix(supabase): trim a pasted storage key again, keep interior whitespace

waleedlatif1

committed

5e855a6

Navigation Menu

Uh oh!

fix(tools): reject path traversal in Drive, BigQuery, Box, Supabase and Contacts ids - #7269

fix(tools): reject path traversal in Drive, BigQuery, Box, Supabase and Contacts ids#7269
waleedlatif1 wants to merge 30 commits into
stagingfrom
fix/storage-path-safety

Commits on Aug 29, 2026

fix(github): reject path-traversal values in interpolated URL segments

fix(github): stop safeUrlPath trimming real filename whitespace

fix(github): permit a whitespace-only path component

fix(github): refuse a padded identifier on state-changing requests

docs(github): record why the strict guards stop at writes

fix(github): reject a backslash in safeEncodedUrlPathSegment

fix(tools): reject path traversal in Drive, BigQuery, Box, Supabase and Contacts ids

test(tools): stop the coverage pin from being blind to non-function URLs

test(tools): catch balanced traversal and pin the full single-segment shape

fix(bigquery): send one project id in both the URL and the request body

test(bigquery): drop dotted ids from the per-parameter allowlist

docs(box_sign): describe the defect in past tense, not the fixed code

fix(bigquery): derive body identifiers from the path guard, not a bare trim

test(tools): probe sibling branch literals in pairs, not just singly

fix(bigquery): refuse a padded projectId instead of silently resolving it

fix(supabase): report storage path-guard failures as 400, not 500

fix(box_sign): refuse a padded signRequestId instead of silently resolving it

test(tools): stop the preserves-whitespace branch swallowing a rejection

test(tools): fail when a guard rejects a value it must render inert

fix(tools): stop guard errors echoing the rejected value, and close the last swallow

test(supabase): pin both derived parameter groups, not just their total

test(tools): bound the names-the-parameter match to whole words

test(bigquery): assert the body project id unconditionally

test(supabase): track #7262 permitting a whitespace-only path component

test(tools): single discovery sweep, and record why the assertions are exact

refactor(tools): use #7262's strictUrlPathSegment and delete the local copy

test(bigquery): compare URL and body to each other, not to two literals

fix(tools): stop applying the strict guard to read routes

test(bigquery): complete the exemption list and pin it

fix(supabase): trim a pasted storage key again, keep interior whitespace