Waleed 6c476cf592 fix(files): don't reject external URLs containing '..' in file parse validation (#4821) ...

* fix(files): don't reject external URLs containing '..' in file parse validation

The file block's file_fetch operation rejected any external URL whose path
contained '..' (e.g. Slack files-pri slugs with a literal '...') with
'Access denied: path traversal detected'. Traversal checks only apply to
local paths — external http(s) URLs are fetched with SSRF protection
downstream and are never resolved against the filesystem, so they now
short-circuit as valid. Internal /api/files/serve/ URLs keep full traversal
protection.

* test(files): fix external-URL assertion to handle undefined error

* test(files): assert success explicitly in external-URL traversal test

* fix(files): keep traversal protection for https URLs matching internal serve paths

2026-05-30 19:35:45 -07:00

..

docs

improvement(integrations): validate and expand devin, cursor, and greptile (#4820)

2026-05-30 18:53:29 -07:00

realtime

chore(utils): migrate to shared random/ID utilities and add enforcement linting (#4623)

2026-05-15 17:31:27 -07:00

sim

fix(files): don't reject external URLs containing '..' in file parse validation (#4821)

2026-05-30 19:35:45 -07:00