Files
Garry TanandClaude Fable 5 a3f0722080 fix(facts): contain page-row-resolved fence paths within the source tree
The #3069 candidate resolution joins DB-sourced source_path /
import_filename into a filesystem path. Apply the same
isWriteTargetContained guard write-through uses (#1647-slug) so a
hostile or corrupt page row with ../ can't steer the fence read +
rename-over outside localPath. Escaping candidates are treated as
not-found -> stubGuardBlocked (facts route to the DB-only path).

Review finding on PR #3285.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-23 11:19:05 -07:00
..