Reserved/private SQL files (sqlpage/ prefix, dotfiles, .. traversal,
absolute paths) became directly routable over HTTP while their parsed
form was fresh in sql_file_cache. A trusted page loading such a file via
sqlpage.run_sql(...) loads it with privilege and caches it; a later
direct unprivileged request hit the fresh cache entry before the path
guard ran, returning 200 and executing the private SQL instead of 403.
The unprivileged path validation is extracted into
filesystem::validate_unprivileged_path and now enforced before
consulting the cache in both HTTP routing (AppFileStore::contains) and
the unprivileged FileCache::get_with_privilege path.
* docs: warn that static serving follows symlinks under web_root
Operators control web_root contents, so a symlink there is a trusted
deployment artifact. Clarify that SQLPage follows such symlinks during
static file serving, meaning a symlink under web_root pointing to
reserved/private files (sqlpage/ config, dotfiles) or to files outside
web_root would make those targets publicly reachable.
Note added to SECURITY.md (Out of Scope), cross-referenced from the
web_root row in configuration.md and an Unreleased CHANGELOG entry.
* Update web_root description for clarity
Document that the folder/destination_folder argument of
sqlpage.persist_uploaded_file must be chosen by the app author and never
derived from untrusted request data. It is joined directly to the web
root, so a value containing '..' or an absolute path would write the
uploaded file outside the web root. Docs-only clarification of existing
intended behavior; no logic change.
* Improve CI Docker cache reuse
* Ignore git metadata in Docker builds
* Use BuildKit cache mounts for Cargo Docker builds
* Make Docker dependency layer match real build inputs
* Revert "Make Docker dependency layer match real build inputs"
This reverts commit 3a9372150ed30437c0b7872907a3e03ce1c38f5d.
* Revert "Use BuildKit cache mounts for Cargo Docker builds"
This reverts commit dac2c5264bee72fc287877fcfe15e49c319d99dd.
* Test CI incremental Rust caches
* Remove slow Windows port diagnostic
* Narrow Windows incremental cache
* Reuse Linux test artifacts in CI
* Avoid duplicate Linux test execution in CI
* Isolate Docker cache scopes by recipe
* Warm Docker dependencies for lib target
* Warm Docker dependencies with Cargo config
* Stabilize Docker metadata for cache keys
* Use Git context for Docker builds
CI / test (postgres, odbc, Driver=PostgreSQL Unicode;Server=127.0.0.1;Port=5432;Database=sqlpage;UID=root;PWD=Password123!, true) (push) Has been cancelled
Ophir LOJKINE