swaitsandClaude Opus 5.5
725b9beaac
check / check (push) Canceled after 0s
Max-testing pass on ledger-store (security property, rank 2). Blob ids come from the journal, which is untrusted input on disk. BlobStore built paths from any string: an id under four bytes (or with multi-byte characters) panicked on slicing, and exists() would report on any path an id like "../../x" reached. get() never served such bytes (it serves only content whose SHA-256 equals the id), but it read them. Now only a 64-hex-digit id names a blob; anything else is an error from get() and false from exists(), touching nothing. Test a_blob_id_never_reaches_outside_the_blob_store (empty, short, unicode, traversal, absolute, non-hex, 63/65 digits; uppercase hex still works). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX