Peter Evans d9ef76f1ac fix(security): prevent path traversal in credentials file deletion ... Use path.resolve() to normalize paths before comparison in removeIncludeIfCredentials(). The previous startsWith() check was vulnerable to path traversal attacks where a path like "/tmp/runner/../../../etc/passwd" would pass the check but resolve outside RUNNER_TEMP. Also append path.sep to prevent false positives (e.g., /tmp/runner2 matching /tmp/runner).		2026-01-23 10:06:08 +00:00
..
790.index.js	build: update distribution (#4095)	2025-08-05 18:15:22 +01:00
index.js	fix(security): prevent path traversal in credentials file deletion	2026-01-23 10:06:08 +00:00