2 Commits

Include renames

Author	SHA1	Message	Date
google-labs-jules[bot]andPR0M3TH3AN	4a1529fd1a	Fix CI failures: linting and dependency vulnerabilities ... - Apply code formatting fixes (black) to resolve test workflow failures. - Update `pyproject.toml`, `src/requirements.txt`, and lock files to upgrade vulnerable dependencies: - aiohttp -> 3.13.3 - cryptography -> 46.0.5 - orjson -> 3.11.7 (CVE-2025-67221) - pillow -> 12.1.1 (CVE-2026-25990) - pynacl -> 1.6.2 (CVE-2025-69277) - starlette -> 0.52.1 (CVE-2025-62727) - urllib3 -> 2.6.3 (CVE-2025-66418, etc.) - cbor2 -> 5.8.0 (CVE-2025-68131) - pyasn1 -> 0.6.2 (CVE-2026-23490) - python-multipart -> 0.0.22 (CVE-2026-24486) - Manually sync `requirements.lock` from `poetry.lock` as `pip-compile` is unavailable in the environment. Co-authored-by: PR0M3TH3AN <[email protected]>	2026-02-25 19:24:01 +00:00
google-labs-jules[bot]andPR0M3TH3AN	91f39007f0	Fix arbitrary file write via path traversal in backup_parent_seed ... The `backup_parent_seed` API endpoint was vulnerable to arbitrary file write via path traversal. The `path` parameter was used directly to create a `Path` object, which was then passed to `_pm.handle_backup_reveal_parent_seed`. This allowed an attacker to specify an arbitrary path (e.g., `../../evil_file`), which would be used by `encrypt_and_save_file` to write the encrypted seed to that location. This commit fixes the vulnerability by validating that the `path` parameter is a valid filename (i.e., does not contain path separators or parent directory references) before processing it. This ensures that the backup file is always created within the intended fingerprint directory. Co-authored-by: PR0M3TH3AN <[email protected]>	2026-02-16 17:17:44 +00:00