Ettore Di Giacinto a496d989ae fix(oci): reject path-traversal tar entries in the link-copy fallback ...

safeJoin sanitized "../.." entries by clamping them under root instead of
rejecting them, so a malicious entry was silently redirected rather than
refused. Join without the leading-slash trick and reject any entry whose
cleaned path resolves outside root; absolute link targets are still mapped
under root (image-root relative) rather than escaping.

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:opus-4.8 [Claude Code]

2026-07-29 14:07:44 +00:00

..

cosignverify

feat(gallery): verify backend OCI images with keyless cosign (#9823)

2026-05-18 08:02:20 +02:00

blob_test.go

feat(ui): allow to cancel ops (#7264)

2025-11-13 18:41:47 +01:00

blob.go

feat: send a LocalAI User-Agent on registry pulls (#10434)

2026-06-22 08:44:12 +02:00

extract_internal_test.go

fix(backends): fall back to copying links when the filesystem rejects symlinks (#10890)

2026-07-29 14:07:44 +00:00

image_test.go

feat: backend versioning, upgrade detection and auto-upgrade (#9315)

2026-04-11 22:31:15 +02:00

image.go

fix(oci): reject path-traversal tar entries in the link-copy fallback

2026-07-29 14:07:44 +00:00

layer_internal_test.go

fix(oci): retry layer downloads on transient network errors (#10579)

2026-06-28 21:21:08 +02:00

oci_suite_test.go

feat(oci): support OCI images and Ollama models (#2628)

2024-06-22 08:17:41 +02:00

ollama_test.go

feat(ui): allow to cancel ops (#7264)

2025-11-13 18:41:47 +01:00

ollama.go

feat: send a LocalAI User-Agent on registry pulls (#10434)

2026-06-22 08:44:12 +02:00

tarball.go

feat(cli): add command to create custom OCI images from directories (#5844)

2025-07-14 08:21:29 +02:00

useragent_test.go

feat: send a LocalAI User-Agent on registry pulls (#10434)

2026-06-22 08:44:12 +02:00

useragent.go

feat: send a LocalAI User-Agent on registry pulls (#10434)

2026-06-22 08:44:12 +02:00