Fix path traversal and concurrency race conditions issues - #212

Merged

thelovekesh merged 36 commits into

mainfrom

fix/traversal-issues

May 5, 2026

Commits on May 5, 2026

Fix path traversal due to package name
thelovekesh
committed
61200e2
Add func to validate project relative path
thelovekesh
committed
797524e
Add validation for content and bin dir
thelovekesh
committed
02e03c6
Add max compressed size safety
thelovekesh
committed
331b197
Fix bufferedReader pool leak
thelovekesh
committed
5aaf960
Add closer on tarballer
thelovekesh
committed
f645c71
Fix orphaned backup files in content dir
thelovekesh
committed
7fac8c0
Add error in installer to fail early if unable to create directories
thelovekesh
committed
6c44b75
Fix mutation of included files in archive instance
thelovekesh
committed
d3e73d4
Remove redundant comment
thelovekesh
committed
efba5c5
Add tarball size exceed error at packing time
thelovekesh
committed
a34ff12
Fix buffer pool size
thelovekesh
committed
65c3b9a
Add func to validate dep names
thelovekesh
committed
700c216
Add dep names validation
thelovekesh
committed
77645e8
Add hardcoded perms while creating files for tar
thelovekesh
committed
685dc9f
Remove overriding walk dir errors
thelovekesh
committed
0f33487
Add safeguards for sparsed tar files causing size bloat
thelovekesh
committed
694ce59
Limit reader to only assign size as per tar entry
thelovekesh
committed
b01fc21
Remove tmp dir and clean stale staging files
thelovekesh
committed
ca70df4
Add `github.com/gofrs/flock`
thelovekesh
committed
c2d7879
Add ctx and close on installer
thelovekesh
committed
4c492c7
Add wpm workspace lock
thelovekesh
committed
d8d3511
Add better fs operations for installer and remove gc pauses
thelovekesh
committed
2da0c6a
Fix removal of temp dir after installation
thelovekesh
committed
a0ee89e
Update base dir param name
thelovekesh
committed
5906c47
Add workspace locking in possible wpm write operations
thelovekesh
committed
d772a61
Add lock acquire waiting message
thelovekesh
committed
bd048c4
Remove locks from http cache api
thelovekesh
committed
d3253cd
Remove singleflight from http caching, rather callers should limit duplicate requests
thelovekesh
committed
01f69de
Fix the rt order
thelovekesh
committed
db877ad
Add function to validate dist tags
thelovekesh
committed
90ac3a7
Add validation for package names passed as args
thelovekesh
committed
6f87b39
Fix dist tag validator
thelovekesh
committed
6c50910
Remove cache override for fetching manifest
thelovekesh
committed
390ff47
Check error values
thelovekesh
committed
ad745e2
Fix max compressed size limit in error message
thelovekesh
committed
e472f6f