spawn/packages
A 4f4b535c8d
fix(security): validate remotePath and harden base64 interpolation in uploadConfigFile (#2669)
Add strict character validation for remotePath to prevent command injection
via crafted paths. Use shellQuote for tempRemote in the shell command. Add
a base64 output assertion to document and enforce the safety of single-quoted
interpolation for settingsB64.

Fixes #2668

Agent: security-auditor

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-03-15 19:04:19 -07:00
..
cli fix(security): validate remotePath and harden base64 interpolation in uploadConfigFile (#2669) 2026-03-15 19:04:19 -07:00
shared feat: add downloadFile to CloudRunner + local OpenClaw config merge (#2636) 2026-03-14 15:47:32 -07:00