Karthikeyan Ganesh 49c4da6d4b fix: strip control characters from sanitized filenames (#9151) ...

Prevent tab, newline, and other ASCII control characters from appearing
in S3 object keys generated from user-provided upload filenames.

Fixes #9127

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-07-28 17:52:46 +05:30

..

core

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

exporters

fix(api): sanitize XLSX export cells to prevent formula injection (#9224)

2026-06-10 11:32:13 +05:30

filters

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

instance_config_variables

chore: remove Intercom integration and chat support components (#8875)

2026-04-10 00:16:45 +05:30

openapi

[SILO-1026] feat: add estimates external API endpoints (#8664)

2026-03-30 15:30:02 +05:30

permissions

[WEB-8095] fix: scope page-version reads to the URL project (GHSA-g49r/ghcr) (#9380)

2026-07-16 16:03:06 +05:30

porters

fix(api): sanitize XLSX export cells to prevent formula injection (#9224)

2026-06-10 11:32:13 +05:30

__init__.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

analytics_events.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

analytics_plot.py

fix: prevent ORM field injection via segment parameter in analytics (GHSA-93x3-ghh7-72j3) (#8864)

2026-04-07 16:04:48 +05:30

build_chart.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

cache.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

color.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

constants.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

content_validator.py

fix(api): require at least one alphanumeric char in workspace name (#9278)

2026-06-20 17:36:37 +05:30

csv_utils.py

fix(api): sanitize XLSX export cells to prevent formula injection (#9224)

2026-06-10 11:32:13 +05:30

cycle_transfer_issues.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

date_utils.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

email.py

[WEB-5917] fix: generate clean plain text from HTML email template #8535

2026-02-17 00:44:52 +05:30

error_codes.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

exception_logger.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

global_paginator.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

grouper.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

host.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

html_processor.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

imports.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

ip_address.py

fix: harden webhook/link/OAuth-avatar SSRF (advisory clusters A/B/C/E) (#9163)

2026-05-31 00:12:23 +05:30

issue_filters.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

issue_relation_mapper.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

issue_search.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

logging.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

markdown.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

order_queryset.py

feat(api): add lite list endpoints for projects, members, cycles, and modules (#9410)

2026-07-17 17:40:26 +05:30

otlp_endpoints.py

[WEB-7447] feat: migrate CE telemetry from OTLP traces to OTLP metrics (#9156)

2026-05-28 18:34:27 +05:30

paginator.py

[WEB-8012] fix: prevent ORM group_by/sub_group_by injection in issue endpoints (#9347)

2026-07-13 20:40:01 +05:30

path_validator.py

fix: strip control characters from sanitized filenames (#9151)

2026-07-28 17:52:46 +05:30

timezone_converter.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

url_security.py

fix: harden webhook/link/OAuth-avatar SSRF (advisory clusters A/B/C/E) (#9163)

2026-05-31 00:12:23 +05:30

url.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

uuid.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30