mirror of
https://github.com/Jeuners/ECC.git
synced 2026-09-09 23:12:30 +02:00
bd9083ca1e
- gateguard (GHSA-4v57-ph3x-gf55): add a quote-aware detection pass that
dequotes command words and splits on UNQUOTED separators incl. newlines, so
newline-separated commands, quoted command words ('rm'/"rm"), quoted
find -exec, and sh/bash -c wrappers are all classified destructive. Additive —
existing 133 cases still pass; +7 bypass regressions + a false-positive guard
(rm inside a quoted echo arg stays allowed). 140/140.
- Windows CI: format-code.ts emitted backslash paths via path.normalize, breaking
forward-slash assertions on all Windows matrix cells — force forward slashes.
- claw.js (CodeQL #1 js/polynomial-redos): bound parseTurns input so the lazy
[\s\S]*? body can't drive O(n^2) scanning on adversarial history files.
Full suite 2852/2852; lint green.
|
||
|---|---|---|
| .. | ||
| ci | ||
| commands | ||
| docs | ||
| hooks | ||
| integration | ||
| lib | ||
| scripts | ||
| __init__.py | ||
| codex-config.test.js | ||
| conftest.py | ||
| opencode-config.test.js | ||
| opencode-plugin-hooks.test.js | ||
| opencode-tools.test.js | ||
| plugin-manifest.test.js | ||
| run-all.js | ||
| test_astraflow_provider.py | ||
| test_atlas_provider.py | ||
| test_builder.py | ||
| test_claude_provider.py | ||
| test_executor.py | ||
| test_invariant_runner.py | ||
| test_provider_tools.py | ||
| test_resolver.py | ||
| test_templates.py | ||
| test_types.py | ||