From f0cbfc913ecbd53e314c46405f7435f44f769ea3 Mon Sep 17 00:00:00 2001 From: matevip Date: Sun, 31 May 2026 07:58:04 +0800 Subject: [PATCH] fix(wiki): default source-path validation to fail-closed in production profile --- .../src/main/resources/application-mysql.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/mateclaw-server/src/main/resources/application-mysql.yml b/mateclaw-server/src/main/resources/application-mysql.yml index 919d3d94..d7e0cafd 100644 --- a/mateclaw-server/src/main/resources/application-mysql.yml +++ b/mateclaw-server/src/main/resources/application-mysql.yml @@ -25,3 +25,13 @@ spring: h2: console: enabled: false + +# Production (multi-tenant server) hardening: fail closed on source-path +# validation. With no allowed-source-roots configured, every KB source +# directory is rejected rather than allowing full-filesystem reads — so a +# missing allow-list cannot silently re-open arbitrary directory scanning. +# Operators set mate.wiki.allowed-source-roots to permit specific roots. +# The default profile (H2 / desktop / single-tenant) leaves this off. +mate: + wiki: + require-allowed-roots: true