Mac: clarify runtime comments

2026-06-28 17:01:53 +03:00 · 2025-12-09 00:08:19 +01:00
parent bc01488a75
commit 5674c9f4c2
12 changed files with 21 additions and 4 deletions
@@ -135,6 +135,7 @@ final class WebChatServer: @unchecked Sendable {
        }
        let fileURL = root.appendingPathComponent(path)
        webChatServerLogger.debug("WebChatServer resolved file=\(fileURL.path, privacy: .public)")
+        // Simple directory traversal guard: served files must live under the bundled web root.
        guard fileURL.path.hasPrefix(root.path) else {
            self.send(status: 403, mime: "text/plain", body: Data("Forbidden".utf8), over: connection)
            return