mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-10-31 19:17:13 +00:00
6e8f44d72b
Some checks failed
Docker Dev Branch Images Build / build (Dockerfile, lc-dev, node) (push) Has been cancelled
Docker Dev Branch Images Build / build (Dockerfile.multi, lc-dev-api, api-build) (push) Has been cancelled
GitNexus Index / index (push) Has been cancelled
GitNexus Index / post-index (push) Has been cancelled
Nested skill files (references/, scripts/, assets/) returned 404 when opened, while top-level SKILL.md worked. The file routes matched a single `:relativePath` segment, so a nested path only resolves when the encoded `%2F` reaches Node intact. Reverse proxies (nginx, Traefik, k8s ingress, ALB, Cloudflare) commonly normalize `%2F` to a literal slash before forwarding, which turns the path into multiple segments the single-segment route can no longer match. Switch the GET/DELETE file routes to an Express 5 splat (`*relativePath`) and reconstruct the path from the decoded segments, so nested files resolve whether the client sends `%2F` or a proxy decoded it to a literal slash. Security: add a shared `isSafeSkillFilePath` validator (extracted from the import validator, single source of truth) and reject traversal/absolute/ empty-segment paths at the route layer. Lookups remain exact DB matches, so the user-supplied path never touches the filesystem. Also drops a latent double-decode (Express already decodes route params). Closes #14190 |
||
|---|---|---|
| .. | ||
| app | ||
| cache | ||
| config | ||
| db | ||
| models | ||
| server | ||
| strategies | ||
| test | ||
| utils | ||
| jest.config.js | ||
| jsconfig.json | ||
| package.json | ||
| typedefs.js | ||