fix: patch path traversal in export_report and create_set_template (v1.28.0)

Both handlers accepted a user-supplied output_path without boundary
validation, allowing MCP clients to write files to arbitrary filesystem
locations. A new safe_output_path() helper canonicalizes the parent
directory and asserts the resolved path stays within the allowed base
directory before any fs::write() call.

Also fixes pre-existing unused-import/dead-code warnings that blocked
the -D warnings release build.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

This commit is contained in:

Devid HW

2026-04-19 08:19:45 +07:00

co-authored by

Claude Sonnet 4.6

parent d41c51bae4

commit 2b136b845b

5 changed files with 51 additions and 15 deletions

Cargo.lock

Generated

+1 -1

View File

@@ -481,7 +481,7 @@ dependencies = [
 [[package]]
 name = "mt5-quant"
 version = "1.27.0"
 version = "1.28.0"
 dependencies = [
  "anyhow",
  "base64",