fix: harden MultiMC/authlib/IO trust boundaries (#8–#13) #14

Merged

layue13 merged 1 commits from cursor/fix-open-security-issues-1729 into main

2026-11-09 21:19:55 +00:00

Author	SHA1	Message	Date
layue13	551bd4cef2	fix: harden MultiMC/authlib/IO trust boundaries (#8–#13) Mirror Repository / Mirror to CNB (push) Skipped Details Mirror Repository / Mirror to Gitee (push) Skipped Details Java CI / build (pull_request) Successful in 12m50s Details - #8: do not import MultiMC PreLaunch/Wrapper/JVM overrides from packs - #9: filter dangerous +jvmArgs from MultiMC patches / lwjgl3ify - #10: cap HTTP body reads at 16 MiB - #11: guard FileUtils.copyDirectory against path escape - #12: allow only http/https/mailto in openLink - #13: follow authlib api-location only on same-host HTTPS	2026-11-09 21:19:30 +00:00

Author

SHA1

Message

Date

layue13

551bd4cef2

fix: harden MultiMC/authlib/IO trust boundaries (#8–#13)

Mirror Repository / Mirror to CNB (push) Skipped

Details

Mirror Repository / Mirror to Gitee (push) Skipped

Details

Java CI / build (pull_request) Successful in 12m50s

Details

- #8: do not import MultiMC PreLaunch/Wrapper/JVM overrides from packs
- #9: filter dangerous +jvmArgs from MultiMC patches / lwjgl3ify
- #10: cap HTTP body reads at 16 MiB
- #11: guard FileUtils.copyDirectory against path escape
- #12: allow only http/https/mailto in openLink
- #13: follow authlib api-location only on same-host HTTPS

2026-11-09 21:19:30 +00:00