v1.4.462

nari-labs/dia2v1.4.462Jul 28, 2026by github-actions[bot]

AI Summary

This is a security patch release that blocks path traversal attacks in pattern name lookups to prevent arbitrary file reads.

Key Highlights

Security Fix: Blocked path traversal attacks in pattern name lookup
Added guard in getFromDB to prevent directory escape via '..'
Added i18n key 'pattern_invalid_name' to all 11 locale files
Added test cases covering common traversal variants

Full Release Notes

## Changes

### PR [#2123](https://github.com/danielmiessler/Fabric/pull/2123) by [ksylvan](https://github.com/ksylvan) and [OdinKral](https://github.com/OdinKral): fix: block path traversal in pattern name lookup

- **Security Fix:** Blocked path traversal attacks in pattern name lookup (closes #2094) — pattern names containing `..` could previously escape the patterns directory and read arbitrary files via `filepath.Join`; a guard has been added at the top of `getFromDB`, an i18n key `pattern_invalid_name` has been added to all 11 locale files, and test cases now cover all common traversal variants.
- New translations for the "invalid pattern" user-facing string.