fix: validate file path in Blueprints::import() to prevent SSRF/LFI (CWE-918)#3656

Open

javokhir-sec wants to merge 23 commits into

Leantime:masterfrom

javokhir-sec:fix/ssrf-lfi-blueprints-import

Commits on Jul 21, 2026

fix: validate file path in Blueprints::import() to prevent SSRF/LFI

javokhir-sec
and
claude
committed
fix(blueprints): harden import() path validation against SSRF/LFI

javokhir-sec
and
claude
committed
fix(blueprints): address Copilot review — TOCTOU, log level, test assertions

javokhir-sec
and
claude
committed
fix(test): correct XML canvas key to match getDatabaseType()

javokhir-sec
and
claude
committed
fix(test): use correct box name 'problem' from lean canvas template

javokhir-sec
and
claude
committed
style: fix pint formatting
javokhir-sec
committed
fix(test): apply Copilot review — portability, unique names, cleanup
javokhir-sec
committed
fix: use base_path() for userfiles + fix tempnam orphan file
javokhir-sec
committed
fix(test): replace tempnam with rename to avoid orphaned temp files
javokhir-sec
committed
fix(test): proper LFI test using .xml outside allowed dirs
javokhir-sec
committed
fix: create Blueprints/imports directory for allow-list validation
javokhir-sec
committed

Commits on Jul 23, 2026