google-labs-jules[bot] cb3922c00d 🔒 [security fix] Remove unsafe path canonicalization in directory gate ... 🎯 What: Removed filesystem-level path canonicalization in the DataDirGate check (`canon_or_raw`). ⚠️ Risk: An attacker could bypass directory authorization by creating a symlink to an authorized directory, allowing them to redirect arbitrary path reads/writes via TOCTOU (Time-of-Check to Time-of-Use) attacks or misleading unverified paths. 🛡️ Solution: Replaced `fs::canonicalize` with purely lexical path normalization (resolving `.` and `..` in memory) to ensure strict string match validation without following symlinks. Ensure relative paths with `..` that go above the start are handled securely without dropping components incorrectly. Added proper Iterator methods to appease clippy. Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com>		2026-08-19 12:11:11 +00:00
..
main.rs	🔒 [security fix] Remove unsafe path canonicalization in directory gate	2026-08-19 12:11:11 +00:00