A 2630a5d0d8 security: escape single quotes in OAuth server script generation (#1342) ... Prevents potential code injection if malicious parameters containing single quotes are passed to _generate_oauth_server_script(). The function embeds bash variables directly into a Node.js script string using single-quoted JS strings. Without escaping, a crafted parameter like "foo'; malicious(); '" could break out of the string context. While current callers use safe values (randomUUID, tempfile paths, HTML constants), defense-in-depth requires sanitizing at the point of use to prevent future regressions if callers change. Fixes: CWE-94 (Code Injection) Severity: HIGH Impact: Remote code execution if attacker controls OAuth state token, file paths, or HTML content Agent: security-auditor Co-authored-by: spawn-bot <bot@openrouter.ai> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>		2026-02-16 20:27:05 -05:00
..
common.sh	security: escape single quotes in OAuth server script generation (#1342)	2026-02-16 20:27:05 -05:00
github-auth.sh	refactor: decompose ensure_jq and ensure_gh_cli into focused helpers (#994)	2026-02-13 12:14:56 -08:00
key-request.sh	fix: HIGH severity security issues (command injection + weak VNC password) (#1150)	2026-02-14 20:39:48 -05:00