orneryd / NornicDB / 30404484331

89%

Build Type

push

github

Committed by orneryd

Commit Message

fix(security): confine persistence paths with rooted filesystem access

Add shared os.Root-based file helpers that reject non-canonical paths and
retain root capabilities for file-handle lifetime. Migrate search snapshots,
build settings, vector storage, Badger backups, APOC exports, and database
JSON backups away from raw path-based filesystem sinks.

Add traversal regression coverage and validate affected storage, search,
Cypher, security, and database packages.

Coverage Stats

42 of 63 new or added lines in 7 files covered. (66.67%)

24 existing lines in 9 files now uncovered.

147884 of 165935 relevant lines covered (89.12%)

1.04 hits per line