 dependabot[bot]
|
3bf38c962d
|
ci(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#270)
Patch bump for codeql-action across codeql.yml and scorecard.yml.
|
2026-05-09 01:26:58 +02:00 |
|
|
DeusData
|
7bc109ee78
|
Merge pull request #166 from DeusData/dependabot/github_actions/actions/checkout-6.0.2
Bump actions/checkout from 4.2.2 to 6.0.2
|
2026-03-29 11:56:27 +02:00 |
|
|
dependabot[bot]
|
10eb56900a
|
Bump actions/checkout from 4.2.2 to 6.0.2
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4.2.2...de0fac2e4500dabe0009e67214ff5f5447ce83dd)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2026-03-28 05:43:09 +00:00 |
|
|
dependabot[bot]
|
c86b7864f0
|
Bump github/codeql-action from 4.34.1 to 4.35.1
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.34.1 to 4.35.1.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/38697555549f1db7851b81482ff19f1fa5c4fedc...c10b8064de6f491fea524254123dbe5e09572f13)
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2026-03-28 05:42:45 +00:00 |
|
|
Martin Vogel
|
0888726073
|
Add security defense tests + eliminate system() command injection
TDD: 31 security tests covering shell injection prevention, SQLite
authorizer (ATTACH/DETACH blocked), SQL injection via Cypher, path
containment, and shell-free subprocess execution.
- Add cbm_exec_no_shell() in compat_fs: fork+execvp (POSIX), _spawnvp
(Windows) — executes commands without shell interpretation
- Replace system() with cbm_exec_no_shell() for unzip extraction and
version verification in update command — eliminates CodeQL
command-line-injection alerts
- CodeQL: switch to build-mode manual for 100% source file coverage
- CodeQL gate: fix race condition between scan completion and alert API
propagation (60s settle + double-check polling)
- Dismiss TOCTOU in pass_envscan.c (benign read-only directory walk)
|
2026-03-21 23:02:34 +01:00 |
|
|
Martin Vogel
|
aa2b60be7d
|
Fix 29 CodeQL alerts: command injection, snprintf overflow, TOCTOU races
- Command injection (CRITICAL): validate shell args before system() in
update command's unzip and version-check calls
- TOCTOU cli.c: use open(O_CREAT, 0755) + fdopen() to set permissions
atomically instead of fopen() + chmod() after close
- TOCTOU pass_envscan.c: open file first, then fstat() on fd to check
size, eliminating stat-then-open race window
- Overflowing snprintf (11 locations): clamp offset after each append
to prevent unsigned underflow on truncation in cypher.c, store.c,
http_server.c, test_c_lsp.c
- Add CBM_SNPRINTF_APPEND macro in str_util.h for future safe appends
- CodeQL: remove pull_request trigger (only scan push to main)
- CodeQL gate: increase timeout from 30 to 45 minutes
- Add fuzz testing script (random JSON-RPC + Cypher mutations)
- 12 Scorecard governance alerts dismissed (not code vulnerabilities)
|
2026-03-21 22:18:31 +01:00 |
|
|
Martin Vogel
|
f3e4eeafb1
|
Add CodeQL SAST + Scorecard + badges + LICENSE in archives
|
2026-03-21 20:44:31 +01:00 |
|