fix: reject path-traversal sequences in HttpClient::resolveUrl#379

Open

gjtorikian wants to merge 3 commits intomainfrom

fix-path-traversal-resolveurl

Commits on May 1, 2026

fix: reject path-traversal sequences in HttpClient::resolveUrl

gjtorikian
and
claude
committed
fix: percent-decode path before traversal checks in HttpClient

gjtorikian
and
claude
committed

Commits on May 2, 2026

fix(http): close double-encoding bypass in path traversal guard
gjtorikian
committed