Skip to content

Bound repository-controlled control file reads - #2957

Merged
Widthdom merged 11 commits into
mainfrom
fix-issue2844-2856-2857-2870-2858-2871-2872-2867
Jun 2, 2026
Merged

Bound repository-controlled control file reads#2957
Widthdom merged 11 commits into
mainfrom
fix-issue2844-2856-2857-2870-2858-2871-2872-2867

Conversation

@Widthdom

@Widthdom Widthdom commented Jun 2, 2026

Copy link
Copy Markdown
Owner

Summary

  • Adds bounded reads for repository-controlled config, manifest, checkpoint, suggestion-store, git metadata, update-cache, git exclude, hook marker, and DB sample checksum paths.
  • Preserves prior BOM-aware text decoding behavior after bounded reads.
  • Adds focused regression tests for each fixed issue.

Changelog

  • changelog.d/unreleased/2844.security.md
  • changelog.d/unreleased/2856.security.md
  • changelog.d/unreleased/2857.security.md
  • changelog.d/unreleased/2858.security.md
  • changelog.d/unreleased/2867.security.md
  • changelog.d/unreleased/2870.security.md
  • changelog.d/unreleased/2871.security.md
  • changelog.d/unreleased/2872.security.md

Validation

  • dotnet run --project tools/CodeIndex.Changelog -- check
  • dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll index . --json
  • dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
  • dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --no-build --framework net8.0 --filter "FullyQualifiedName~CdidxConfigFileTests|FullyQualifiedName~WorkspaceCommandRunnerTests|FullyQualifiedName~IndexCommandRunnerTests|FullyQualifiedName~SuggestionStoreTests|FullyQualifiedName~ProgramRunnerTests|FullyQualifiedName~GitHelperTests|FullyQualifiedName~HookCommandRunnerTests|FullyQualifiedName~DbPathResolverTests"
  • dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --no-build --framework net9.0 --filter "FullyQualifiedName~CdidxConfigFileTests|FullyQualifiedName~WorkspaceCommandRunnerTests|FullyQualifiedName~IndexCommandRunnerTests|FullyQualifiedName~SuggestionStoreTests|FullyQualifiedName~ProgramRunnerTests|FullyQualifiedName~GitHelperTests|FullyQualifiedName~HookCommandRunnerTests|FullyQualifiedName~DbPathResolverTests"
  • Codex adversarial review found a BOM-handling regression in the first pass; fixed with BOM-aware decoding and BOM config/manifest tests.

Notes

Fixes #2844
Fixes #2856
Fixes #2857
Fixes #2870
Fixes #2858
Fixes #2871
Fixes #2872
Fixes #2867

@Widthdom
Widthdom merged commit fc22ac7 into main Jun 2, 2026
10 checks passed
@Widthdom
Widthdom deleted the fix-issue2844-2856-2857-2870-2858-2871-2872-2867 branch June 3, 2026 23:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment