Skip to content

1.0.126

Choose a tag to compare

View all tags
@nictuku nictuku released this 23 Sep 16:42
· 2 commits to main since this release
1.0.126
8f8eda6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security: fixes GHSA-2h5x-4qc8-3x27 — save_ad_image_locally built its destination path from the caller-supplied ad_id and output_dir with no validation, so an absolute path or .. traversal in either argument wrote the downloaded image outside the intended directory (and created directories to get there). Only affects installs that set META_ADS_ENABLE_SAVE_AD_IMAGE_LOCALLY; the tool is not registered otherwise, and the hosted MCP does not enable it.

What's changed

  • fix(security): resolve_ad_image_save_path() now decides the destination before anything touches disk — ad_id must be a Meta object id, the image hash must be filename-safe, and output_dir is resolved with realpath and must land on or under an allowed base directory, rejecting absolute paths, traversal and symlinks out of the base (#166).
  • The base is the working directory the server was started in, which is where the documented ad_images default has always resolved; set META_ADS_IMAGE_OUTPUT_DIR to move it.

Full changelog: 1.0.125...1.0.126

Assets 2
Loading