• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

thumbor / thumbor / 26696628394
89%

Build:
DEFAULT BRANCH: master
Ran 30 May 2026 10:32PM UTC
Jobs 5
Files 103
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

30 May 2026 10:29PM UTC coverage: 88.889% (-0.03%) from 88.917%
26696628394

push

github

marcelometal
fix(file_loader): enforce root boundaries after decoding paths

Decode percent-encoded paths before root-boundary validation to block
%2e%2e traversal through filters such as watermark and frame.

Replace the startswith() guard with os.path.commonpath() so sibling prefixes
outside FILE_LOADER_ROOT_PATH are not accepted.

Preserve compatibility for literal percent-encoded filenames by trying the
raw path only after a repeated root-boundary check. Add tests for encoded
traversal, mixed traversal, sibling-prefix escape, and normal file loading.

10 of 12 new or added lines in 1 file covered. (83.33%)

3912 of 4401 relevant lines covered (88.89%)

4.44 hits per line

Uncovered Changes

Lines Coverage ∆ File
2
93.75
-6.25% thumbor/loaders/file_loader.py
Jobs
ID Job ID Ran Files Coverage
1 run-3.10 - 26696628394.1 30 May 2026 10:32PM UTC 103
88.89
GitHub Action Run
2 run-3.11 - 26696628394.2 30 May 2026 10:32PM UTC 103
88.89
GitHub Action Run
3 run-3.13 - 26696628394.3 30 May 2026 10:32PM UTC 103
88.89
GitHub Action Run
4 run-3.14 - 26696628394.4 30 May 2026 10:32PM UTC 103
88.89
GitHub Action Run
5 run-3.12 - 26696628394.5 30 May 2026 10:32PM UTC 103
88.89
GitHub Action Run
Source Files on build 26696628394
  • Tree
  • List 103
  • Changed 1
  • Source Changed 1
  • Coverage Changed 1
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Github Actions Build #26696628394
  • 3b986d13 on github
  • Prev Build on master (#26690811383)
  • Next Build on master (#26696821789)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc