Skip to content

Security fix #524: prevent path traversal, unsafe eval, and key leakage#531

Closed
kallal79 wants to merge 1 commit intoControlCore-Project:devfrom
kallal79:security-fix-524
Closed

Security fix #524: prevent path traversal, unsafe eval, and key leakage#531
kallal79 wants to merge 1 commit intoControlCore-Project:devfrom
kallal79:security-fix-524

Conversation

@kallal79
Copy link
Copy Markdown

@kallal79 kallal79 commented Apr 2, 2026

Files changed:

concore/concore.py
concore/mkconcore.py
concore/concore.hpp
demo/pwrap.py
ratc/pwrap.py

except:
init_simtime_ym = "[0.0, 0.0, 0.0]"

if apikey:
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That was a debug log. Ideally it shouldn't be there. But in any case, it was printing the actual apikey. Now you are printing a string. That makes the log meaningless.

@pradeeban
Copy link
Copy Markdown
Member

pradeeban commented Apr 3, 2026

There are several merge conflicts. I believe you developed against the main and then changed the PR to dev.

concore/concore.py
concore/mkconcore.py
concore/concore.hpp
are critical files. Best not to be touched without very careful attention.

demo/pwrap.py
ratc/pwrap.py
are old experiments. Not worth our attention.

I close this PR. Please do not re-attempt this PR as I see more of a risk in potential to break the core concore protocol.

@pradeeban pradeeban closed this Apr 3, 2026
@kallal79
Copy link
Copy Markdown
Author

kallal79 commented Apr 3, 2026

OK

@kallal79 kallal79 deleted the security-fix-524 branch April 3, 2026 20:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants