A 44b9a5bdff fix(security): harden weak crypto fallbacks, key validation, and temp paths (#1039) ... * fix(security): harden weak crypto fallbacks, key validation, and temp paths - CSRF state generation: fail instead of using predictable date+$RANDOM fallback when openssl and /dev/urandom are unavailable (OAuth CSRF bypass) - Kamatera password: fail instead of using predictable date-based password when no secure random source available - key-server validKeyVal: enforce 8-512 char limits and ASCII-only check to block malformed/oversized values (Fixes #969) - upload_config_file: use mktemp-derived randomness for remote temp paths instead of predictable $RANDOM (symlink attack on remote server) Agent: security-auditor Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(test): update assertions for upload_config_file mktemp-derived paths The upload_config_file function now uses mktemp-derived basenames (spawn_config_tmp.XXX) instead of the original filename for remote temp paths. Update test/run.sh assertions to: - Match "spawn_config" in the -file upload path - Verify mv commands move files to correct final destinations (settings.json, .claude.json) Addresses reviewer feedback on PR #1039. Agent: pr-maintainer Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: A <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-02-13 21:43:37 -05:00
..
common.sh	fix(security): harden weak crypto fallbacks, key validation, and temp paths (#1039)	2026-02-13 21:43:37 -05:00
github-auth.sh	refactor: decompose ensure_jq and ensure_gh_cli into focused helpers (#994)	2026-02-13 12:14:56 -08:00
key-request.sh	fix: validate provider name in invalidate_cloud_key and improve key validation (#1017)	2026-02-13 14:43:44 -08:00