amir a0d759364e Security: guard against path traversal from hostile remotes ...

WebDAV already sanitizes server-supplied names, but SFTP passed entry.name
through unfiltered, and the engine had no central guard — a malicious or
compromised remote could return '../../x' and (on the JavaFile backend) write
outside the sync root.

- SyncEngine: isUnsafeSyncPath() rejects empty, absolute, and any '..'-segment
  path; every file is checked before any read/write/delete (covers all providers).
- SftpProvider.listFiles: drop '.'/'..' and names containing path separators.
- PathSafetyTest covers traversal, backslash, absolute, and empty cases.

2026-06-05 02:54:21 +00:00

..

src

Security: guard against path traversal from hostile remotes

2026-06-05 02:54:21 +00:00

build.gradle.kts

Atomic transfers + signed-release CI

2026-06-05 02:15:23 +00:00

proguard-rules.pro

Fix R8 dontwarn rules, WorkManager init, and release signing config

2026-05-22 20:34:30 +00:00