70bc47eadc
Command injection (real fix): - which.ts: switch to array-args execa, remove shell:true - execFileNoThrowPortable/execSyncWrapper/imagePaste/execFileNoThrow: security comments Log injection: - handlers/mcp.tsx: security comments (secrets already redacted) ReDoS: - debugFilter.ts: split regex, add input length guard Sanitization bypass: - stripHtml.ts: loop-based script/style removal - claudemd.ts: loop-based HTML comment stripping - sedEditParser.ts: single-pass char scan replaces chained replaces - bingAdapter.ts: URL.hostname comparison instead of string includes Tests: 3068 pass, 0 fail |
||
|---|---|---|
| .. | ||
| bg | ||
| handlers | ||
| src | ||
| transports | ||
| bg.ts | ||
| exit.ts | ||
| ndjsonSafeStringify.ts | ||
| print.ts | ||
| remoteIO.ts | ||
| rollback.ts | ||
| structuredIO.ts | ||
| up.ts | ||
| update.ts | ||