Repository navigation
Conversation
…s, no PATH fallback when installed - run(): explicit shell:false and a refusal of any command that is not an absolute path - resolveTool(): an installed app resolves only user-updated and bundled tools; PATH lookup is dev-only and skips relative entries - systools.ts: OS utilities (taskkill, attrib, tar, rundll32, shutdown, pgrep, open, osascript) by absolute path - tests/spawn-safety.test.ts; watchdog tests use /bin/sh - release gate restores the dev instance's settings and clears its rows, so no empty gate folder survives a run - ISA decision and ISC-84 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016MFr7iyxH3khcCfBGFyN8J
…e-flight updater - checksum.ts: SHA-256 of the download must match the release's SHA2-256SUMS entry for exactly that file and, when present, GitHub's asset digest - download and sums URLs pinned to the yt-dlp project's release storage; fail closed, nothing unverified reaches the disk - engine.log records the verified hash, or REJECTED with the reason - updateEngine() is single-flight: startup check, self-heal and the Settings button share one run (fixes "downloaded yt-dlp failed to run" when two overlapped) - tests/checksum.test.ts; README; ISA decision and ISC-85 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016MFr7iyxH3khcCfBGFyN8J
…can no longer hang; cleanup inventory rule; ISC-86 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016MFr7iyxH3khcCfBGFyN8J
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release-candidate branch for the one open item under Security and quality: CodeQL
js/shell-command-injection-from-environmentonelectron/engine/run.ts.No shell was involved, but the class the alert points at had three real gaps, closed here:
run()now passesshell: falseand refuses any command that is not an absolute path.yt-dlp,ffmpeg,aria2cordeno; it uses only the user-updated or bundled copy. PATH lookup remains for development and skips relative entries.taskkill,attrib,tar,rundll32,shutdown,pgrep,open,osascript) are launched by absolute path. On Windows a bare name is searched for in the working directory before PATH.Verification: typecheck, 33 unit tests (5 new), locale parity, release gate 14/14.
Draft on purpose: not for merge until reviewed. Opened so CodeQL analyses the branch.
🤖 Generated with Claude Code
https://claude.ai/code/session_016MFr7iyxH3khcCfBGFyN8J