spark-store-project/spark-store
15
0
Fork 0
mirror of https://gitee.com/spark-store-project/spark-store synced 2026-08-09 14:00:48 +08:00
Code Issues Packages Projects Releases Wiki Activity
165 Commits 16 Branches 158 Tags
7dc8b7f77fee49427a9af42b3241b2dbed4ddd1b
Commit Graph
2 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
google-labs-jules[bot]andvmomenv 1270405907 🔒 fix: Command Injection in install-manager.ts and CI failures 
- Set `shell: false` in `spawn` calls in `install-manager.ts` to prevent command injection.
- Updated `AGENTS.md` to use the secure `shell: false` pattern in examples.
- Removed `package-lock.json` from `.gitignore` to support reproducible builds.
- Updated GitHub Actions workflows to use `npm install` instead of `npm ci` as a robust fallback.

Co-authored-by: vmomenv <51269338+vmomenv@users.noreply.github.com>
 2026-03-10 16:08:16 +00:00
google-labs-jules[bot]andvmomenv 828ffd86e8 🔒 fix: Command Injection vulnerability in install-manager.ts 
- Changed `shell: true` to `shell: false` in `spawn` calls within `electron/main/backend/install-manager.ts`.
- Updated `AGENTS.md` documentation to reflect the security best practice.
- Verified that the fix prevents command injection using a reproduction script.

Co-authored-by: vmomenv <51269338+vmomenv@users.noreply.github.com>
 2026-03-10 15:53:44 +00:00