fix(dav): reject ambiguous nested authorization encodings - #1345

Open

seonghobae wants to merge 31 commits into

fix/dav-single-decode-authorization

Commits on Aug 14, 2026

test(dav): reject ambiguous nested authorization encodings
seonghobae
committed
3dc8420
fix(dav): enforce single-decode authorization boundary
seonghobae
committed
029c065
test(dav): reproduce dropped normalized route path
seonghobae
committed
532a0b4
fix(dav): propagate canonical authorization path
seonghobae
committed
fae5b62
Merge branch 'develop' into fix/dav-single-decode-authorization
opencode-agent[bot]
authored
b0e530d
test(dav): align route assertions with framework decoding
seonghobae
committed
0a897db
Merge protected develop into DAV authorization fix
seonghobae
committed
9e82a88
Merge protected develop into DAV authorization fix
seonghobae
committed
f7abb82

Commits on Aug 15, 2026

test(security): reject unsafe local-provider address classes
seonghobae
committed
b66af0d
fix(security): bound local LLM provider networks
seonghobae
committed
81c8890
docs(security): record DAV and local-provider network boundaries
seonghobae
committed
5b0a888
test(security): cover IPv6 local-provider network boundaries
seonghobae
committed
60feaad
Merge protected develop into security fix lane
seonghobae
committed
df2bf10
test(data): reproduce cross-organization document access
seonghobae
committed
d6a870d
test(data): inspect only document WHERE scope
seonghobae
committed
c05855f
fix(data): enforce document organization scope
seonghobae
committed
2b8a18f
merge(develop): integrate current protected base
seonghobae
committed
7cfa1bf
test(data): cover remaining document organization scopes
seonghobae
committed
17b3452
test(data): use one api.data import style
seonghobae
committed
0ca9624
Merge branch 'develop' into fix/dav-single-decode-authorization
opencode-agent[bot]
authored
3a56fed
test(security): reject loopback DNS rebinding
seonghobae
committed
95f23c2
fix(security): bind loopback access to local host identity
seonghobae
committed
d73e9e4
test(security): scope loopback opt-in to local identities
seonghobae
committed
7052b66

Commits on Aug 16, 2026

Commits on Aug 17, 2026

Commits on Aug 20, 2026

Merge remote-tracking branch 'origin/develop' into HEAD
seonghobae
committed
89d8850

Commits on Aug 22, 2026

Merge branch 'develop' into fix/dav-single-decode-authorization
opencode-agent[bot]
authored
07954b2

Commits on Aug 26, 2026

Merge branch 'develop' into fix/dav-single-decode-authorization
seonghobae
authored
8c6a51e