diff --git a/CHANGELOG.md b/CHANGELOG.md index a5c4c745..400dc10f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## v1.4.462 (2026-07-28) + +### PR [#2123](https://github.com/danielmiessler/Fabric/pull/2123) by [ksylvan](https://github.com/ksylvan) and [OdinKral](https://github.com/OdinKral): fix: block path traversal in pattern name lookup + +- **Security Fix:** Blocked path traversal attacks in pattern name lookup (closes #2094) — pattern names containing `..` could previously escape the patterns directory and read arbitrary files via `filepath.Join`; a guard has been added at the top of `getFromDB`, an i18n key `pattern_invalid_name` has been added to all 11 locale files, and test cases now cover all common traversal variants. +- New translations for the "invalid pattern" user-facing string. + ## v1.4.461 (2026-07-28) ### PR [#2152](https://github.com/danielmiessler/Fabric/pull/2152) by [AUTHENSOR](https://github.com/AUTHENSOR): fix: shell-escape extension values to prevent command injection diff --git a/cmd/fabric/version.go b/cmd/fabric/version.go index 0f595fc8..6a3a0a03 100644 --- a/cmd/fabric/version.go +++ b/cmd/fabric/version.go @@ -1,3 +1,3 @@ package main -var version = "v1.4.461" +var version = "v1.4.462" diff --git a/cmd/generate_changelog/changelog.db b/cmd/generate_changelog/changelog.db index 2105f7b8..69aec759 100644 Binary files a/cmd/generate_changelog/changelog.db and b/cmd/generate_changelog/changelog.db differ diff --git a/cmd/generate_changelog/incoming/2167.txt b/cmd/generate_changelog/incoming/2167.txt deleted file mode 100644 index 0a5760cb..00000000 --- a/cmd/generate_changelog/incoming/2167.txt +++ /dev/null @@ -1,4 +0,0 @@ -### PR [#2123](https://github.com/danielmiessler/Fabric/pull/2123) by [ksylvan](https://github.com/ksylvan) and [OdinKral](https://github.com/OdinKral): fix: block path traversal in pattern name lookup - -- **Security Fix:** Blocked path traversal attacks in pattern name lookup (closes #2094) — pattern names containing `..` could previously escape the patterns directory and read arbitrary files via `filepath.Join`; a guard has been added at the top of `getFromDB`, an i18n key `pattern_invalid_name` has been added to all 11 locale files, and test cases now cover all common traversal variants. -- New translations for the "invalid pattern" user-facing string. diff --git a/nix/pkgs/fabric/version.nix b/nix/pkgs/fabric/version.nix index a86de663..9a91820f 100644 --- a/nix/pkgs/fabric/version.nix +++ b/nix/pkgs/fabric/version.nix @@ -1 +1 @@ -"1.4.461" +"1.4.462"