Files
codebase-memory-mcp/tests
Martin Vogel d21693df58 fix(security): allow the bare wget token the shell pass compares
The v0.12.0 release smoke blocked every binary in its string audit:
"BLOCKED: Dangerous commands found in binary: wget". The line is the bare
string "wget" that src/pipeline/pass_shell.c compares a script's program
name with, and records as the `via` of a curl / wget HTTP_CALLS edge
(3b93db06). The binary never runs it.

Allow that whole line only, like the rst grammar's bare "telnet". A line
that carries a wget command (flags, a target, a URL) stays blocked; the
contract test now pins both cases.

Proof on the release run's own artifacts (run 38644765106, main 8df0639c):
linux-amd64-portable and darwin-arm64 binaries BLOCKED before, all three
audits OK after. test_security_strings_allowlist.sh: 49 passed; with the
allowlist line reverted, the new bare-token case fails.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
2026-10-15 03:18:42 +02:00
..
2026-10-14 23:56:37 +02:00
2026-10-11 16:57:48 +02:00