mirror of
https://github.com/storytold/effectcraft.git
synced 2026-10-26 11:07:54 -06:00
file.uninstallScript and script_code joined the name from the request into Scripts/<name> and handed it to the settings store, so "../.." reached files outside the settings folder (uninstall deleted them; run-by-name ran them). Accept only bare file names (and, on Windows, none of its reserved names), require a .jsx/.js name, and skip refused names in the script list. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>