eric/scriptorium
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

Clarify artifact root symlink behavior

Browse Source
This commit is contained in:
Eric Rakestraw
2026-07-05 00:22:54 +00:00
parent 6742def4d3
commit 872c166ed7
6 changed files with 49 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docs/integrations/http-api.md
View File

@@ -71,10 +71,13 @@ Input reference types currently supported by runtime artifact loading:
- `inline`
HTTP `file` references require `server.artifact_root` or `serve --artifact-root`.
Relative file URIs resolve inside that root. Absolute file URIs are accepted
only when they remain inside the root. Requests that escape the root, including
`..` traversal and absolute paths outside the root, return
`400 artifact_not_allowed`. `inline` references do not require an artifact root.
Relative file URIs resolve against that root. Absolute file URIs are accepted
only when they are lexically inside the root. Requests that escape the root by
lexical traversal, including `..` traversal and absolute paths outside the root,
return `400 artifact_not_allowed`. Symlinks inside the root are followed by the
operating system, including symlinks that point outside the root. The artifact
root must not be writable by untrusted users. `inline` references do not require
an artifact root.
HTTP file artifacts above the configured artifact limit return
`413 artifact_too_large`. Inline bodies are bounded by the request body limit.