hotel-manage-stack/management
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
management/updater
History
jtricerolph 90c2e69d51 Replace execSync/exec shell interpolation with spawn arg arrays in updater 
sshGet() and deploy() built SSH commands via template literal string
interpolation, which would allow shell injection if host/path values
from the app registry were tampered with. Replaced with spawnAsync()
using shell: false and explicit argv arrays. Added path validation
guard (/^\/opt\/[a-z0-9-]+$/) before both SSH calls. Also removes
the event-loop-blocking execSync in deploy().

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-07-13 09:25:09 +00:00
..
src Replace execSync/exec shell interpolation with spawn arg arrays in updater 2026-07-13 09:25:09 +00:00
deploy-map.js Replace static deploy-map with dynamic auth registry 2026-07-01 20:49:39 +00:00
Dockerfile Initial commit: management 2026-07-01 12:09:54 +00:00
package.json Initial commit: management 2026-07-01 12:09:54 +00:00