You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PluginsArea: what it touches
ImprovementsKind: in v2.1.246,
ImprovementsSection of the release
What
Paths in the marketplace cache are now checked one component at a time before any read or write. A link whose chain points at a network path is refused, a link pointing outside its own marketplace directory is refused, and directory listings skip links they cannot judge.
Details
The check runs first on reads and on copy, move, write, truncate, chmod, delete, stat and digest.
Active only when the v5 storage backend is in use.
Evidence
a link that leaves its marketplace tree is never followed
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
