- Fixed git sha parameter injection by adding input validation that rejects sha values starting with "-" (search for
"Invalid sha") - Fixed git clone argument injection by adding
--separator to prevent URL and ref arguments from being interpreted as flags (search for"A.push('--', H, $)") - Fixed git remote HEAD reference validation to verify that detected references actually exist before using them (search for
"refs/heads/"in remote HEAD check) - Fixed cache directory path sanitization to prevent
.and..from being used as path components (search for"z === \".\" || z === \"..\"") - Fixed cursor state display logic to properly update cursor state instead of only handling specific opposite-pair transitions (cursor state handling)
- Fixed damage rectangle merging to properly expand bounds in all directions when new damage extends beyond existing bounds
- Added
--argument separator insedsafety validation to prevent sed expression injection attacks (search for"aI9"— new sed expression extractor at line ~303347) - Fixed handling of broken symlinks during directory copy operations, now skips them with a warning (search for
"copyDir: skipping broken symlink") - Fixed symlink escape detection during directory copy to prevent following symlinks outside the source tree (search for
"copyDir: skipping symlink escaping source tree")
EntryKind: in v2.1.117,
Bug FixesSection of the release