A 116305f32c fix: Secure upload_file() against command injection in Railway, Modal, and Koyeb (#221) ... Railway: Missing base64 -w0 caused newline injection; unescaped remote_path in single quotes allowed single-quote breakout command injection. Now uses base64 -w0 with macOS fallback, printf '%q' for path escaping, and routes through run_server instead of direct railway run bash -c. Modal: Remote path was embedded in single quotes without escaping, allowing single-quote breakout. Now uses printf '%q' for safe path escaping. Koyeb: Used fragile deny-list validation for remote_path (rejecting specific characters) and base64 without -w0 flag. Replaced with printf '%q' escaping and added base64 -w0 with macOS fallback. Agent: security-auditor Co-authored-by: A <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-02-10 12:33:15 -08:00
..
common.sh	fix: Secure upload_file() against command injection in Railway, Modal, and Koyeb (#221)	2026-02-10 12:33:15 -08:00