opensource/mateclaw
2
0
Fork 0
mirror of https://gitee.com/mateos/mateclaw.git synced 2026-09-14 19:45:08 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(wiki): default source-path validation to fail-closed in production profile

Browse Source
This commit is contained in:
matevip 2026-05-31 07:58:04 +08:00
parent 4ffe7026d2
commit f0cbfc913e
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
mateclaw-server/src/main/resources/application-mysql.yml
View File

@ -25,3 +25,13 @@ spring:
h2: h2:
console: console:
enabled: false enabled: false
# Production (multi-tenant server) hardening: fail closed on source-path
# validation. With no allowed-source-roots configured, every KB source
# directory is rejected rather than allowing full-filesystem reads — so a
# missing allow-list cannot silently re-open arbitrary directory scanning.
# Operators set mate.wiki.allowed-source-roots to permit specific roots.
# The default profile (H2 / desktop / single-tenant) leaves this off.
mate:
wiki:
require-allowed-roots: true