Files: a '..' path shows '.. › ..' breadcrumbs and an item count under the error #139

Closed
opened 2026-09-25 22:18:00 +00:00 by kayg · 1 comment
Owner

Severity: low

Problem

/files?path=..%2F..%2Fetc: the server refuses the path (400, good), but the page shows the breadcrumbs "Files › .. › .. › etc" and "0 items · 347 KB used" under the error "This folder could not be opened". /home/kayg/Developer/calternal/target/breakit/run1/files-traversal_1440-paper.png.

Expected

The client normalizes or refuses .. segments before it renders breadcrumbs, and the footer is hidden in the error state.

Found by the break-it sweep (#117). Re-run: cd apps/web && bun run build && bun e2e/breakit.mjs --keep <dir> (script on branch job/breakit-fixes). Screenshots: /home/kayg/Developer/calternal/target/breakit (run 1 in run1/, fix checks in verify/).

**Severity:** low ## Problem `/files?path=..%2F..%2Fetc`: the server refuses the path (400, good), but the page shows the breadcrumbs "Files › .. › .. › etc" and "0 items · 347 KB used" under the error "This folder could not be opened". `/home/kayg/Developer/calternal/target/breakit/run1/files-traversal_1440-paper.png`. ## Expected The client normalizes or refuses `..` segments before it renders breadcrumbs, and the footer is hidden in the error state. Found by the break-it sweep (#117). Re-run: `cd apps/web && bun run build && bun e2e/breakit.mjs --keep <dir>` (script on branch `job/breakit-fixes`). Screenshots: `/home/kayg/Developer/calternal/target/breakit` (run 1 in `run1/`, fix checks in `verify/`).
Author
Owner

Fixed. The Files E2E passed for the encoded ../../etc path. It checks the folder error state and confirms there is no item or quota summary, traversal breadcrumb, or file list beneath the error.

Fixed. The Files E2E passed for the encoded `../../etc` path. It checks the folder error state and confirms there is no item or quota summary, traversal breadcrumb, or file list beneath the error.
kayg closed this issue 2026-09-26 12:52:14 +00:00
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#139
No description provided.