seb/dashback
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sharp by wasm

Browse Source
This commit is contained in:
seb
2026-10-28 01:46:51 +01:00
parent 1c5385061c
commit e7884c03ef
20 changed files with 530 additions and 364 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/api/routes/vfs/exec.md
View File

@@ -20,7 +20,7 @@ Applets return typed CSV, not JSON: `result` is a `;`-separated CSV string with
response also carries `columns` (name/type) and `rows` (data row count). Only declared columns are
emitted, in header order; missing values become empty cells. Execution runs in the same isolated worker
sandbox as the `javascript_execute` tool — including authenticated `fetch()` against this API,
`fs`/`vfs`, `sharp`, ExcelJS, PDFKit and WebCrypto globals.
`fs`/`vfs`, `optimizeImage`, ExcelJS, PDFKit and WebCrypto globals.
The path is taken from the URL (like `DELETE /vfs/{*path}`); the run arguments are the JSON body.
Path traversal (`..`), null bytes, and backslashes are rejected with HTTP 400, as is a path that does