posimai-root/posimai-dev
posimai 33100d9efc security(posimai-dev): セッション API パストラバーサル修正
/api/sessions/:id で path.join 後に SESSIONS_DIR 外への逸脱を検証。
正常な ID(UUID 等)には影響なし。requireLocal により localhost/Tailscale 限定だが念のため多層防御。
2026-04-24 20:48:06 +09:00
..
.gitignore security(dev): SSRF fix, WS limit, log rotation, BIND_HOST, sw.js API cache skip, .gitignore 2026-04-24 16:44:01 +09:00
favicon.svg fix: Posimai API check via /api/vps-health proxy, add favicon 2026-04-02 19:36:18 +09:00
index.html fix(security): add SRI to xterm CDN, add manifest id, noreferrer to target=_blank 2026-04-17 18:42:38 +09:00
manifest.json fix(security): add SRI to xterm CDN, add manifest id, noreferrer to target=_blank 2026-04-17 18:42:38 +09:00
package-lock.json feat(ext): integrate rule engine — scan works without API key 2026-04-14 23:05:19 +09:00
package.json feat: add posimai-dev — self-hosted terminal portal with xterm.js 2026-03-30 23:23:28 +09:00
posimai-dev.service fix: systemd service — correct node path to /usr/bin/node 2026-03-31 00:28:52 +09:00
server.js security(posimai-dev): セッション API パストラバーサル修正 2026-04-24 20:48:06 +09:00
sessions.html fix(dev): replace hardcoded #F3F4F6 with var(--text), scope header/icon-btn overrides 2026-04-24 16:33:27 +09:00
setup-kiosk.sh fix: handle destroyed logStream in pty, update kiosk URL to https:3333 2026-03-31 13:37:38 +09:00
station-b.html fix(security): add SRI to xterm CDN, add manifest id, noreferrer to target=_blank 2026-04-17 18:42:38 +09:00
station.html fix(security): add SRI to xterm CDN, add manifest id, noreferrer to target=_blank 2026-04-17 18:42:38 +09:00
sw.js security(dev): SSRF fix, WS limit, log rotation, BIND_HOST, sw.js API cache skip, .gitignore 2026-04-24 16:44:01 +09:00