fix: contain generated files and assets and harden SQL rendering

2026-10-12 20:59:46 +02:00
parent 2fa48335d3
commit dd97413b8e
68 changed files with 2328 additions and 798 deletions
@@ -264,3 +264,11 @@ docker rm postgres-test
 - **SQL Directory Reader**: `pkg/readers/sqldir/` - Read scripts from filesystem
 - **Script Model**: `pkg/models/models.go` - Script structure definition
 - **pgx Documentation**: https://github.com/jackc/pgx - PostgreSQL driver docs
+
+## Model embed access
+
+SQL directory readers expand embed directives within their trusted input root.
+When executing unexpanded directives from a model, explicitly configure
+`WriterOptions.Metadata["asset_root"]` with the allowed directory. Script
+`source_path` metadata alone never authorizes file reads. Paths, symlinks, regular
+file types, and the 64 MiB asset-size limit are checked before reading.