Commit Graph

4 Commits

Author SHA1 Message Date
James Feng
368dd99d01 fix(security): prevent shell injection in headersHelper (#36)
- Parse headersHelper command with shell-quote to reject operators
- Call execFileNoThrowWithCwd(cmd, args) without shell: true
- Remove shell option from ExecFileWithCwdOptions type entirely
- Add headersHelper.test.ts with injection rejection test
- Fix existing MCP test mocks for compatibility

Test: MCP tests 91/0, full suite 3058 pass (0 new failures)
2026-06-03 16:59:16 +08:00
claude-code-best
ce29527a67 test: 添加一大堆测试文件 2026-04-02 20:28:08 +08:00
claude-code-best
4f323efb61 test: Phase 5 — 添加 12 个测试文件 (+209 tests, 1177 total)
新增覆盖: effort, tokenBudget, displayTags, taggedId,
controlMessageCompat, MCP normalization/envExpansion,
gitConfigParser, formatBriefTimestamp, hyperlink, windowsPaths, notebook

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 10:11:43 +08:00
claude-code-best
21ac9e441f test: Phase 2-4 — 添加 12 个测试文件 (+321 tests, 968 total)
Phase 2 (轻 Mock): envUtils, sleep/sequential, memoize, groupToolUses, dangerousPatterns, outputLimits
Phase 3 (补全): zodToJsonSchema, PermissionMode, envValidation
Phase 4 (工具模块): mcpStringUtils, destructiveCommandWarning, commandSemantics

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 09:29:01 +08:00