Repository navigation
fix(signals-dashboard): refuse ';' desk paths on Windows and keep stash reads read-only - #23
Merged
Merged
Conversation
…indows Terminal Windows Terminal reads every ';' on its command line as a command separator, even inside an argument (microsoft/terminal#13264). Group folder names only pass the path-traversal check, so a desk under a folder such as a;b-desks/ could make `wt -d <path>` start a second command. The shared launcher now refuses to launch when any Windows Terminal argument holds ';', which also covers a workshop path with one, and the caller falls back to copying the path, as it already does for unsafe desk names. Discovery is unchanged. This copy's test harness doesn't stub process launches, so the launch regression test lives in the github/awesome-copilot copy. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 23af3266-c56b-4f37-a967-a13587283c2b
…t restore Page loads and the refresh action read the stash outside withStashLock, but readStash wrote its normalized list back after awaiting filesystem checks. A refresh that overlapped a restore could write its older snapshot last and stash the restored desk again. Reads no longer write: each read still drops expired entries and normalizes name-only ones, and only the locked stash and restore paths persist the list. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 23af3266-c56b-4f37-a967-a13587283c2b
Merged
8 of 17 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mirrors the review fixes on github/awesome-copilot#6302, one commit each:
;on its command line as a command separator, even inside an argument (Non-standard command line parsing misinterprets semicolons inside arguments microsoft/terminal#13264), so a desk under a group folder such asa;b-desks/could makewt -d <path>start a second command. The launcher now refuses to launch when any Windows Terminal argument holds;(this also covers a workshop path with one), and the canvas falls back to copying the path, as it does for unsafe desk names.readStashruns outsidewithStashLockbut wrote its normalized list back after awaiting filesystem checks, so a refresh that overlapped a restore could stash the restored desk again. Reads no longer write; only the locked stash and restore paths persist the list.Tests: 34 of 34. The new race test fails without its fix. This copy's test harness doesn't stub process launches, so the launch regression test lives in the awesome-copilot copy.