Eric WagonerandClaude Fable 5 6ac50c4d58 Harden the static file server against path traversal (security review) ...

The internet-facing static handler now decodes the URL (rejecting bad
encodings and null bytes), anchors the containment check with a
trailing separator so sibling-prefix directories cannot slip past,
and realpath-resolves the final file to defeat symlink escapes —
serving only what provably lives inside the built client directory.
Deployed and probed live: normal requests 200, literal and
percent-encoded traversal attempts both 403.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-16 00:56:16 -04:00

..

index.ts

Harden the static file server against path traversal (security review)

2026-08-16 00:56:16 -04:00

rooms.ts

Support 2-6 players: the L, the cross, and the 3x2 from the rulebook

2026-08-16 00:08:15 -04:00

store.ts

Hash seat tokens at rest (security review finding)

2026-08-16 00:03:36 -04:00