Merge commit from fork

* Reject path traversal in SCM URL filepath parsing * Harden parseGitUrlSafe against encoding bypass variants
2026-03-04 07:28:36 +01:00
parent 30ff9810f5
commit 1513a0b132
7 changed files with 192 additions and 7 deletions
@@ -0,0 +1,5 @@
+---
+'@backstage/integration': patch
+---
+
+Fixed a security vulnerability where path traversal sequences in SCM URLs could be used to access unintended API endpoints using server-side integration credentials.