-
Notifications
You must be signed in to change notification settings - Fork 112
Update to version v4.0.0 #219
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
deployment/ecr/gaab-strands-agent/test/test_runtime_mcp_discovery.py
Dismissed
Show dismissed
Hide dismissed
| ]; | ||
| // Pattern that allows safe file names while preventing path traversal attacks | ||
| // Must end with a supported file extension and cannot contain path separators (/ or \) | ||
| export const MULTIMODAL_FILENAME_PATTERN = `^[a-zA-Z0-9](?:[a-zA-Z0-9_-]|[\x20](?=[a-zA-Z0-9_-]))*\.(${SUPPORTED_MULTIMODAL_FILE_EXTENSIONS.join('|')})$`; |
Check failure
Code scanning / CodeQL
Useless regular-expression character escape High
regular expression
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 days ago
To address this issue, we need to ensure that the pattern string being used to build the RegExp has the correct escaped backslash. In a JS string, to represent the regex \. (a literal dot), you must write \\. so the string passed to the RegExp engine is \.. Therefore, in the file source/infrastructure/lib/utils/constants.ts on line 410, we should change *\.( to *\\.(. Only this line needs to be changed. No new imports or methods are needed, just fix the escape in the pattern string.
-
Copy modified line R410
| @@ -407,5 +407,5 @@ | ||
| ]; | ||
| // Pattern that allows safe file names while preventing path traversal attacks | ||
| // Must end with a supported file extension and cannot contain path separators (/ or \) | ||
| export const MULTIMODAL_FILENAME_PATTERN = `^[a-zA-Z0-9](?:[a-zA-Z0-9_-]|[\x20](?=[a-zA-Z0-9_-]))*\.(${SUPPORTED_MULTIMODAL_FILE_EXTENSIONS.join('|')})$`; | ||
| export const MULTIMODAL_FILENAME_PATTERN = `^[a-zA-Z0-9](?:[a-zA-Z0-9_-]|[\x20](?=[a-zA-Z0-9_-]))*\\.(${SUPPORTED_MULTIMODAL_FILE_EXTENSIONS.join('|')})$`; | ||
| export const MULTIMODAL_FILE_EXPIRATION_DAYS = 2; |
| ...MULTIMODAL_SUPPORTED_DOCUMENT_FORMATS | ||
| ]; | ||
|
|
||
| export const MULTIMODAL_FILENAME_PATTERN = `^[a-zA-Z0-9](?:[a-zA-Z0-9_-]|[\x20](?=[a-zA-Z0-9_-]))*\.(${MULTIMODAL_SUPPORTED_FILE_FORMATS.join('|')})$`; |
Check failure
Code scanning / CodeQL
Useless regular-expression character escape High
regular expression
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 days ago
To fix this problem, change the pattern in line 78 from \. to \\. so that the RegExp parser receives the correct escape. This should only affect the string in the definition of MULTIMODAL_FILENAME_PATTERN, in source/ui-chat/src/utils/constants.ts. No extra imports or support are needed; it's a simple string literal change.
-
Copy modified line R78
| @@ -75,7 +75,7 @@ | ||
| ...MULTIMODAL_SUPPORTED_DOCUMENT_FORMATS | ||
| ]; | ||
|
|
||
| export const MULTIMODAL_FILENAME_PATTERN = `^[a-zA-Z0-9](?:[a-zA-Z0-9_-]|[\x20](?=[a-zA-Z0-9_-]))*\.(${MULTIMODAL_SUPPORTED_FILE_FORMATS.join('|')})$`; | ||
| export const MULTIMODAL_FILENAME_PATTERN = `^[a-zA-Z0-9](?:[a-zA-Z0-9_-]|[\x20](?=[a-zA-Z0-9_-]))*\\.${MULTIMODAL_SUPPORTED_FILE_FORMATS.join('|')}$`; | ||
|
|
||
| //model provider | ||
| export const MODEL_PROVIDER = { |
tabdunabi
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
[4.0.0] - 2025-11-20
Added
Security
3.14.2and4.1.1to mitigate CVE-2025-6471810.5.0to mitigate CVE-2025-647560.3.80to mitigate CVE-2025-65106