osobhandClaude Fable 5.1
8f62cb44e0
The VDS resolver joined the source file name stored in the HDF5 file straight onto the opened file's directory. That name is untrusted: an absolute path replaces the base directory outright and `..` components climb out of it, so a crafted file could make the reader open any path the process can reach. Only plain relative paths of normal components are accepted now; anything else resolves to "source not found". Co-Authored-By: Claude Fable 5.1 <[email protected]>