Claude ad08ac005e fix: prevent command injection in download_cli.py ... Add strict validation to CLAUDE_CLI_VERSION environment variable to prevent command injection vulnerability during CLI download process. Security Issue: - Unsanitized environment variable was interpolated into PowerShell and Bash commands at lines 75 and 85 - Severity: MEDIUM - Category: command_injection Fix: - Added regex validation to only allow semantic versions (X.Y.Z) or "latest" - Pattern: ^([0-9]+\.[0-9]+\.[0-9]+|latest)$ - Raises ValueError for invalid input Testing: - Created comprehensive test suite (tests/test_download_cli.py) - Verified valid versions accepted (1.0.0, latest) - Verified malicious inputs rejected (injection attempts, invalid formats) - Full backward compatibility maintained Changes: - scripts/download_cli.py: Add validation in get_cli_version() - tests/test_download_cli.py: New test suite with 70+ test cases - SECURITY_FIX_SUMMARY.md: Documentation of vulnerability and fix		2025-12-12 22:18:35 +00:00
..
build_wheel.py	fix: remove emojis from build_wheel.py for Windows compatibility (#342)	2025-11-18 17:59:48 -08:00
download_cli.py	fix: prevent command injection in download_cli.py	2025-12-12 22:18:35 +00:00
initial-setup.sh	feat: add pre-push hook for lint checks (#254)	2025-10-14 09:26:49 -07:00
pre-push	feat: add pre-push hook for lint checks (#254)	2025-10-14 09:26:49 -07:00
update_cli_version.py	feat: bundle Claude Code CLI in pip package (#283)	2025-11-18 17:21:15 -08:00
update_version.py	feat: bundle Claude Code CLI in pip package (#283)	2025-11-18 17:21:15 -08:00