Skip to content

Deeds 0.3.3: security fixes from a private report

Choose a tag to compare

View all tags
@danielmiessler danielmiessler released this 09 Oct 05:26
· 4 commits to main since this release
v0.3.3
31a7a71

Security fixes from a private report by elhoim (David André). Thank you.

  • A bunfig.toml in the repo being analyzed can no longer preload code: every launcher pins the CLI's own config.
  • The macOS sandbox re-exec no longer loads the repo's .env, and the git that extract runs gets a clean environment.
  • Author names, paths and cap names are escaped before they reach the terminal.
  • Redaction covers OpenPGP, SSH2 and PuTTY private keys and passwords of any shape, escaped quotes included.
  • Diffs are cut at a line boundary, so a secret is never split before it is redacted.
  • The skill pre-approves only analyze, help and version. --html and --out stay inside the working directory and never write through a symlink, unless you pass --allow-any-output.
  • Clones skip the git-lfs smudge filter.
  • git log output is parsed so an author name cannot shift fields or abort a run.
  • In --mode full the diff is fenced as untrusted data, and a commit yields at most one deed of each kind.

Install: curl -fsSL https://raw.githubusercontent.com/danielmiessler/deeds/main/install.sh | sh

Assets 4
Loading