LiveJava

What's Changed

This release focuses on hardening the Web IDE server with several security fixes and new configuration options.

🔒 Security Fixes

• Fixed a path traversal vulnerability in the /api/build endpoint (High): project names are now strictly validated (only letters, digits, _ and - allowed). Previously, a crafted project parameter could delete arbitrary directories on the server or compile and execute code outside the scripts folder. As defense-in-depth, the build process now also verifies via canonical path checks that the project directory cannot escape the scripts folder.
• Fixed a JSON injection / stored XSS vulnerability in the /api/tree endpoint (Medium): file names and status values are now properly escaped before being embedded in JSON, so files with special characters in their names can no longer break the JSON structure or inject scripts into the editor UI.

🐛 Bug Fixes

• Fixed an unhandled ArrayIndexOutOfBoundsException when an empty ?key= parameter was sent to the Web IDE server.

✨ New Features

• Session timeout: editor tokens now expire automatically after a period of inactivity. Configurable via the new session-timeout-minutes option (default: 60 minutes, set to 0 to disable). Every authorized request refreshes the session (sliding timeout).
• Reverse proxy / HTTPS support: new behind-reverse-proxy config option (default: false). When enabled, the real client IP is read from the X-Forwarded-For header so the IP lock keeps working correctly behind an HTTPS reverse proxy (Nginx, Caddy, etc.). An example Nginx HTTPS configuration has been added to config.yml.

⚠️ Security note: Editor tokens are transmitted in plain text over HTTP. For internet-facing servers, we strongly recommend running the Web IDE behind an HTTPS reverse proxy. Only enable behind-reverse-proxy if you actually run one, otherwise clients could spoof the X-Forwarded-For header.

Upgrading is strongly recommended for all users running the Web IDE.