Martin Vogel 0888726073 Add security defense tests + eliminate system() command injection ...

TDD: 31 security tests covering shell injection prevention, SQLite
authorizer (ATTACH/DETACH blocked), SQL injection via Cypher, path
containment, and shell-free subprocess execution.

- Add cbm_exec_no_shell() in compat_fs: fork+execvp (POSIX), _spawnvp
  (Windows) — executes commands without shell interpretation
- Replace system() with cbm_exec_no_shell() for unzip extraction and
  version verification in update command — eliminates CodeQL
  command-line-injection alerts
- CodeQL: switch to build-mode manual for 100% source file coverage
- CodeQL gate: fix race condition between scan completion and alert API
  propagation (60s settle + double-check polling)
- Dismiss TOCTOU in pass_envscan.c (benign read-only directory walk)

2026-03-21 23:02:34 +01:00

..

hooks

Add time-bomb + MCP file read audit, tracked pre-commit hooks

2026-03-21 16:43:48 +01:00

build.sh

Auto-detect WIN32_LIBS in Makefile, remove shell quoting entirely

2026-03-19 00:00:19 +01:00

clean.sh

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

clone-bench-repos.sh

v0.5.1: Fix C/C++/CUDA/GLSL function extraction, add config linker and tests

2026-03-06 17:50:18 +01:00

embed-frontend.sh

Fix Windows build: add zip pkg, portable embed (od replaces xxd)

2026-03-19 10:59:14 +01:00

env.sh

Fix production build errors, add build step to Docker test infra

2026-03-18 17:15:46 +01:00

lint.sh

Use cc (Apple Clang) on macOS, gcc on Linux — unified CI/local parity

2026-03-18 13:08:33 +01:00

security-allowlist.txt

Add security defense tests + eliminate system() command injection

2026-03-21 23:02:34 +01:00

security-audit.sh

Pin Actions to SHA + enforce via security audit + Dependabot

2026-03-21 16:57:17 +01:00

security-fuzz-random.sh

Fix 29 CodeQL alerts: command injection, snprintf overflow, TOCTOU races

2026-03-21 22:18:31 +01:00

security-fuzz.sh

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

security-install.sh

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

security-network.sh

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

security-strings.sh

Fix security audit false positives in CI

2026-03-20 18:47:55 +01:00

security-ui.sh

Robust UI audit: skip inline URL scan on dist/, keep structural checks

2026-03-20 20:56:52 +01:00

security-vendored.sh

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

setup-windows.ps1

Add cross-platform setup scripts and CI release workflow

2026-02-25 10:07:45 +01:00

setup.sh

Fix binary move command in setup script (#16)

2026-03-06 21:19:38 +01:00

smoke-test.sh

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00

test.sh

Auto-detect WIN32_LIBS in Makefile, remove shell quoting entirely

2026-03-19 00:00:19 +01:00

vendor-grammar.sh

Add Go LSP hybrid type resolver, config store, and supporting infrastructure

2026-03-12 13:26:13 +01:00

vendored-checksums.txt

Add 8-layer security test suite + hardening

2026-03-20 18:19:15 +01:00