Eric WagonerandClaude Fable 5
6ac50c4d58
The internet-facing static handler now decodes the URL (rejecting bad encodings and null bytes), anchors the containment check with a trailing separator so sibling-prefix directories cannot slip past, and realpath-resolves the final file to defeat symlink escapes — serving only what provably lives inside the built client directory. Deployed and probed live: normal requests 200, literal and percent-encoded traversal attempts both 403. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>