fix: anchor profile directory traversal

2026-07-17 02:39:42 +08:00
parent 1fa7e0fb2d
commit 6c06859783
4 changed files with 265 additions and 29 deletions
@@ -27,7 +27,7 @@ func run(args []string, input io.Reader, output io.Writer) error {
 	if err != nil {
 		return err
 	}
-	application, err := app.New(profile.NewOwnedFileStore(configuration.Path, configuration.Owner))
+	application, err := app.New(profile.NewOwnedFileStoreAt(configuration.Path, configuration.Owner, configuration.TrustedRoot))
 	if err != nil {
 		return err
 	}