mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-10-25 06:33:13 +08:00
Martin Vogel
aa2b60be7d
- Command injection (CRITICAL): validate shell args before system() in update command's unzip and version-check calls - TOCTOU cli.c: use open(O_CREAT, 0755) + fdopen() to set permissions atomically instead of fopen() + chmod() after close - TOCTOU pass_envscan.c: open file first, then fstat() on fd to check size, eliminating stat-then-open race window - Overflowing snprintf (11 locations): clamp offset after each append to prevent unsigned underflow on truncation in cypher.c, store.c, http_server.c, test_c_lsp.c - Add CBM_SNPRINTF_APPEND macro in str_util.h for future safe appends - CodeQL: remove pull_request trigger (only scan push to main) - CodeQL gate: increase timeout from 30 to 45 minutes - Add fuzz testing script (random JSON-RPC + Cypher mutations) - 12 Scorecard governance alerts dismissed (not code vulnerabilities)