Rin 6a8947217c fix(server): sanitize repo name to prevent argument injection (#1305) ... * fix(server): sanitize repo name to prevent argument injection Sanitizes the extracted repository name to prevent argument injection during git clone operations and ensures compatibility with various file systems. 1. Strips leading dashes to prevent git command-line argument injection. 2. Replaces unsafe directory characters with underscores. 3. Blocks path traversal segments ('.' and '..') and Windows reserved names. 4. Fixes ReDoS vulnerability in parseRepoNameFromUrl regex. 5. Added unit tests for sanitization and path traversal edge cases. * fix(server): expand Windows reserved name check to include extensions - Updated sanitizeRepoName to block Windows reserved names (CON, NUL, etc.) even when they have extensions (e.g., CON.txt). - Corrected regex and added unit tests for these edge cases to resolve CI failures on Windows. - Ref: https://github.com/abhigyanpatwari/GitNexus/pull/1305#issuecomment-4407200914 --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>		2026-05-11 09:38:07 +01:00
..
analyze-job.ts	fix: resolve false 404 errors and stale repo context during multi-repo switching on Windows (#633)	2026-04-10 19:59:16 +01:00
analyze-worker.ts	feat: configure prettier with pre-commit hook (#563)	2026-03-28 14:58:04 +00:00
api.ts	fix(security): log-injection, http-to-file-access, client-side-request-forgery (#1456)	2026-05-09 17:26:32 +01:00
git-clone.ts	fix(server): sanitize repo name to prevent argument injection (#1305)	2026-05-11 09:38:07 +01:00
mcp-http.ts	feat(core): adopt pino structured logger (#1336)	2026-05-07 20:56:25 +01:00
validation.ts	fix(server): use ipKeyGenerator for IPv6 subnet normalisation (#1360) (#1374)	2026-05-06 14:07:37 +01:00