mirror of
https://github.com/lobehub/lobehub
synced 2026-04-21 17:47:27 +00:00
2c1762b85a
* fix kb issue * 🔒 fix(file): validate file size from S3 instead of trusting client input Security fix for GHSA-wrrr-8jcv-wjf5: The file upload feature did not validate the integrity of upload requests, allowing users to manipulate the size parameter to bypass quota limits. Changes: - Add getFileMetadata method to S3 module using HeadObjectCommand - Add getFileMetadata to FileServiceImpl interface and implementations - Update createFile router to fetch actual file size from S3 - Add comprehensive tests for the new functionality - Fix duplicate import in knowledgeBase.test.ts 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * 🐛 fix(ci): use allowed_tools instead of claude_args for claude-translator Fix shell parsing issue where special characters in claude_args were incorrectly split. The parentheses and asterisks in tool patterns like `Bash(gh issue view *)` were being parsed by shell, causing: - "Bash(gh issue view *)" to become ["Bash", "gh", "issue", "view", "*"] Changes: - Replace `claude_args: "--allowed-tools ..."` with `allowed_tools: '...'` - Use colon separator format consistent with other workflows - Simplify tool patterns while maintaining security restrictions 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| actions | ||
| ISSUE_TEMPLATE | ||
| scripts | ||
| workflows | ||
| FUNDING.yml | ||
| PULL_REQUEST_TEMPLATE.md | ||