A aff3b73850 security: fix medium/low findings from scan (#1395) ... * security: fix medium severity findings from scan #763 Addresses remaining medium-severity security findings from issue #763: 1. **Path traversal in invalidate_cloud_key** (shared/key-request.sh) - Removed dots from provider name validation regex - Changed from ^[a-z0-9][a-z0-9._-]{0,63}$ to ^[a-z0-9][a-z0-9_-]{0,63}$ - Prevents path traversal via sequences like "foo..bar" 2. **Background process timeout** (shared/key-request.sh) - Wrapped fire-and-forget key request in timeout 15s - Prevents leaked subprocess if curl hangs beyond --max-time 3. **Rate limiting IP spoofing** (.claude/skills/setup-agent-team/key-server.ts) - Switched from x-forwarded-for header to server.requestIP(req) - Uses actual connection IP instead of spoofable header Agent: security-auditor Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix: add macOS portability for timeout command Address review feedback from security team - timeout command is not available on macOS by default. Added fallback pattern that: - Uses timeout on Linux (prevents subprocess leak) - Falls back to curl --max-time only on macOS This ensures request_missing_cloud_keys() works on both platforms. Agent: pr-maintainer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * security: fix command injection vulnerability in key-request.sh Fixes the critical command injection vulnerability identified in security review. Changes: - Use positional parameters ($1, $2, $3) instead of variable interpolation in bash -c - Pass variables via -- delimiter to prevent shell escaping issues - Replace echo with printf for proper formatting (macOS bash 3.x compat) - Maintain timeout wrapper on Linux and curl --max-time fallback on macOS Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> --------- Co-authored-by: B <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>		2026-02-17 09:29:20 -05:00
..
common.sh	feat(cli): add spawn name for each run (#1397)	2026-02-17 08:05:17 -05:00
github-auth.sh	refactor: decompose ensure_jq and ensure_gh_cli into focused helpers (#994)	2026-02-13 12:14:56 -08:00
key-request.sh	security: fix medium/low findings from scan (#1395)	2026-02-17 09:29:20 -05:00