masci / banks / 28851132359

95%

push

github

fix: validate prompt paths in DirectoryPromptRegistry (#77)

* fix: validate prompt paths in DirectoryPromptRegistry

Prevent path traversal when resolving prompt file names and versions,
and reject poisoned index entries that escape the registry root.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: reject dot-segments in prompt names and versions

Reject "." and ".." path parts in prompt names and path separators in
versions before resolving file paths, preventing overwrite bypass via
equivalent paths like team/../nested.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

111 of 117 branches covered (94.87%)

Branch coverage included in aggregate %.

20 of 24 new or added lines in 1 file covered. (83.33%)

889 of 940 relevant lines covered (94.57%)

0.95 hits per line