From e2b7c2d6b9a04c16e5d2ae247fc9a66ef60af281 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 16 May 2026 15:32:49 +0000 Subject: [PATCH 1/5] =?UTF-8?q?=F0=9F=94=92=20Security=20fix:=20prevent=20?= =?UTF-8?q?command=20injection=20in=20PlatformShellService?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🎯 **What:** The vulnerability fixed was a potential Command Injection in PlatformShellService due to unescaped arguments passed to `Process.Start()` when handling `open` or `xdg-open` commands on OSX and Linux respectively. ⚠️ **Risk:** If a malicious path containing shell metacharacters or flags was passed to these methods, it could lead to arbitrary command execution with the privileges of the application. 🛡️ **Solution:** Used `ProcessStartInfo` with `UseShellExecute = false` and `ArgumentList` to safely pass the path argument without shell expansion. Additionally, prepended `./` to paths starting with `-` to prevent argument injection flags. --- .../Services/PlatformShellService.cs | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/src/SalmonEgg.Infrastructure.Desktop/Services/PlatformShellService.cs b/src/SalmonEgg.Infrastructure.Desktop/Services/PlatformShellService.cs index 57ab9bd0..c05daf8b 100644 --- a/src/SalmonEgg.Infrastructure.Desktop/Services/PlatformShellService.cs +++ b/src/SalmonEgg.Infrastructure.Desktop/Services/PlatformShellService.cs @@ -55,13 +55,27 @@ private Task OpenWithShellAsync(string path) return Task.FromResult(true); } + var sanitizedPath = path.StartsWith("-") ? $"./{path}" : path; + if (RuntimeInformation.IsOSPlatform(OSPlatform.OSX)) { - Process.Start("open", path); + var psi = new ProcessStartInfo + { + FileName = "open", + UseShellExecute = false + }; + psi.ArgumentList.Add(sanitizedPath); + Process.Start(psi); return Task.FromResult(true); } - Process.Start("xdg-open", path); + var linuxPsi = new ProcessStartInfo + { + FileName = "xdg-open", + UseShellExecute = false + }; + linuxPsi.ArgumentList.Add(sanitizedPath); + Process.Start(linuxPsi); return Task.FromResult(true); } catch From 081fc0ef0a8f7d1b76fc612360181fa58942bb18 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 16 May 2026 15:48:29 +0000 Subject: [PATCH 2/5] =?UTF-8?q?=F0=9F=94=92=20Security=20fix:=20prevent=20?= =?UTF-8?q?command=20injection=20in=20PlatformShellService?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🎯 **What:** The vulnerability fixed was a potential Command Injection in PlatformShellService due to unescaped arguments passed to `Process.Start()` when handling `open` or `xdg-open` commands on OSX and Linux respectively. ⚠️ **Risk:** If a malicious path containing shell metacharacters or flags was passed to these methods, it could lead to arbitrary command execution with the privileges of the application. 🛡️ **Solution:** Used `ProcessStartInfo` with `UseShellExecute = false` and `ArgumentList` to safely pass the path argument without shell expansion. Additionally, prepended `./` to paths starting with `-` to prevent argument injection flags. --- .github/workflows/ci-core.yml | 3 +++ .github/workflows/code-quality.yml | 3 +++ SalmonEgg/SalmonEgg/Controls/ChatSkeleton.xaml.cs | 4 +--- .../Presentation/Converters/BoolToVisibilityConverter.cs | 4 +--- .../Converters/ConnectionStatusToColorConverter.cs | 4 +--- .../SalmonEgg/Presentation/Converters/InverseBoolConverter.cs | 4 +--- .../Presentation/Converters/InverseBooleanConverter.cs | 4 +--- .../Converters/MessageDirectionToAlignmentConverter.cs | 4 +--- .../Converters/MessageDirectionToBackgroundConverter.cs | 4 +--- .../Converters/MessageDirectionToBorderThicknessConverter.cs | 4 +--- .../Converters/MessageDirectionToCornerRadiusConverter.cs | 4 +--- .../Converters/MessageDirectionToForegroundConverter.cs | 4 +--- .../Presentation/Converters/PlanStatusToColorConverter.cs | 4 +--- .../SalmonEgg/Presentation/Converters/TimeFormatConverter.cs | 4 +--- .../SalmonEgg/Presentation/Views/GeneralSettingsPage.xaml.cs | 4 +--- 15 files changed, 19 insertions(+), 39 deletions(-) diff --git a/.github/workflows/ci-core.yml b/.github/workflows/ci-core.yml index 4eedb610..884a62f7 100644 --- a/.github/workflows/ci-core.yml +++ b/.github/workflows/ci-core.yml @@ -26,6 +26,9 @@ jobs: with: dotnet-version: ${{ env.DOTNET_VERSION }} + - name: Install wasm-tools workload + run: dotnet workload install wasm-tools + - name: Restore dependencies run: dotnet restore SalmonEgg.sln diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml index c4dd5ae3..035b2876 100644 --- a/.github/workflows/code-quality.yml +++ b/.github/workflows/code-quality.yml @@ -25,6 +25,9 @@ jobs: with: dotnet-version: ${{ env.DOTNET_VERSION }} + - name: Install wasm-tools workload + run: dotnet workload install wasm-tools + - name: Restore dependencies run: dotnet restore SalmonEgg.sln diff --git a/SalmonEgg/SalmonEgg/Controls/ChatSkeleton.xaml.cs b/SalmonEgg/SalmonEgg/Controls/ChatSkeleton.xaml.cs index a7e3f8dc..90e6a131 100644 --- a/SalmonEgg/SalmonEgg/Controls/ChatSkeleton.xaml.cs +++ b/SalmonEgg/SalmonEgg/Controls/ChatSkeleton.xaml.cs @@ -1,8 +1,7 @@ using Microsoft.UI.Xaml; using Microsoft.UI.Xaml.Controls; -namespace SalmonEgg.Controls -{ +namespace SalmonEgg.Controls; public sealed partial class ChatSkeleton : UserControl { public ChatSkeleton() @@ -18,4 +17,3 @@ private void OnLoaded(object sender, RoutedEventArgs e) private void OnUnloaded(object sender, RoutedEventArgs e) => ShimmerStoryboard.Stop(); } -} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/BoolToVisibilityConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/BoolToVisibilityConverter.cs index 3a39b8d1..80df2189 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/BoolToVisibilityConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/BoolToVisibilityConverter.cs @@ -2,8 +2,7 @@ using Microsoft.UI.Xaml; using Microsoft.UI.Xaml.Data; -namespace SalmonEgg.Presentation.Converters -{ +namespace SalmonEgg.Presentation.Converters; /// /// 将布尔值转换为 Visibility /// Requirements: 4.2 @@ -39,4 +38,3 @@ public object ConvertBack(object value, Type targetType, object parameter, strin return false; } } -} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/ConnectionStatusToColorConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/ConnectionStatusToColorConverter.cs index e00d23d9..e6dcd83a 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/ConnectionStatusToColorConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/ConnectionStatusToColorConverter.cs @@ -3,8 +3,7 @@ using Microsoft.UI.Xaml.Media; using SalmonEgg.Domain.Models; -namespace SalmonEgg.Presentation.Converters -{ +namespace SalmonEgg.Presentation.Converters; /// /// 将连接状态转换为颜色 /// Requirements: 4.2 @@ -32,4 +31,3 @@ public object ConvertBack(object value, Type targetType, object parameter, strin throw new NotImplementedException(); } } -} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBoolConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBoolConverter.cs index f4ea2723..09b06bec 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBoolConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBoolConverter.cs @@ -2,8 +2,7 @@ using Microsoft.UI.Xaml; using Microsoft.UI.Xaml.Data; -namespace SalmonEgg.Presentation.Converters -{ +namespace SalmonEgg.Presentation.Converters; /// /// 将布尔值取反后转换为 Visibility /// @@ -27,4 +26,3 @@ public object ConvertBack(object value, Type targetType, object parameter, strin return true; } } -} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBooleanConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBooleanConverter.cs index a1970cd3..8a7d9eae 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBooleanConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBooleanConverter.cs @@ -1,8 +1,7 @@ using System; using Microsoft.UI.Xaml.Data; -namespace SalmonEgg.Presentation.Converters -{ +namespace SalmonEgg.Presentation.Converters; /// /// 将布尔值取反(返回 bool,不是 Visibility) /// 用于 IsEnabled 等需要 bool 的属性 @@ -27,4 +26,3 @@ public object ConvertBack(object value, Type targetType, object parameter, strin return false; } } -} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToAlignmentConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToAlignmentConverter.cs index 0aef72f5..4c87dae6 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToAlignmentConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToAlignmentConverter.cs @@ -2,8 +2,7 @@ using Microsoft.UI.Xaml; using Microsoft.UI.Xaml.Data; -namespace SalmonEgg.Presentation.Converters -{ +namespace SalmonEgg.Presentation.Converters; /// /// 将消息方向转换为对齐方式 /// Requirements: 4.2 @@ -24,4 +23,3 @@ public object ConvertBack(object value, Type targetType, object parameter, strin throw new NotImplementedException(); } } -} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBackgroundConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBackgroundConverter.cs index c63efb26..72249f81 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBackgroundConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBackgroundConverter.cs @@ -3,8 +3,7 @@ using Microsoft.UI.Xaml.Data; using Microsoft.UI.Xaml.Media; -namespace SalmonEgg.Presentation.Converters -{ +namespace SalmonEgg.Presentation.Converters; /// /// 将消息方向转换为背景色画刷 /// 用户发出(True)返回 AccentFillColorDefaultBrush @@ -41,4 +40,3 @@ public object ConvertBack(object value, Type targetType, object parameter, strin throw new NotImplementedException(); } } -} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBorderThicknessConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBorderThicknessConverter.cs index 519db77d..fed9c68d 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBorderThicknessConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBorderThicknessConverter.cs @@ -2,8 +2,7 @@ using Microsoft.UI.Xaml; using Microsoft.UI.Xaml.Data; -namespace SalmonEgg.Presentation.Converters -{ +namespace SalmonEgg.Presentation.Converters; /// /// 将消息方向转换为边框粗细 /// 用户发出(True)返回 0 (无边框,颜色深不需要) @@ -26,4 +25,3 @@ public object ConvertBack(object value, Type targetType, object parameter, strin throw new NotImplementedException(); } } -} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToCornerRadiusConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToCornerRadiusConverter.cs index c6f61a63..80a9c9d0 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToCornerRadiusConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToCornerRadiusConverter.cs @@ -2,8 +2,7 @@ using Microsoft.UI.Xaml; using Microsoft.UI.Xaml.Data; -namespace SalmonEgg.Presentation.Converters -{ +namespace SalmonEgg.Presentation.Converters; /// /// 将消息方向转换为气泡的非对称圆角 /// 用户发出(True)为右下直角,左下圆角 @@ -26,4 +25,3 @@ public object ConvertBack(object value, Type targetType, object parameter, strin throw new NotImplementedException(); } } -} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToForegroundConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToForegroundConverter.cs index 5a7f6ed8..620947ff 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToForegroundConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToForegroundConverter.cs @@ -3,8 +3,7 @@ using Microsoft.UI.Xaml.Data; using Microsoft.UI.Xaml.Media; -namespace SalmonEgg.Presentation.Converters -{ +namespace SalmonEgg.Presentation.Converters; /// /// 将消息方向转换为前景色(文本色)画刷 /// 用户发出(True)返回 TextOnAccentFillColorPrimaryBrush @@ -41,4 +40,3 @@ public object ConvertBack(object value, Type targetType, object parameter, strin throw new NotImplementedException(); } } -} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/PlanStatusToColorConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/PlanStatusToColorConverter.cs index 1fd29337..66d8fcd2 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/PlanStatusToColorConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/PlanStatusToColorConverter.cs @@ -4,8 +4,7 @@ using Microsoft.UI.Xaml.Media; using SalmonEgg.Domain.Models.Plan; -namespace SalmonEgg.Presentation.Converters -{ +namespace SalmonEgg.Presentation.Converters; /// /// 将计划条目状态转换为对应的颜色 /// @@ -32,4 +31,3 @@ public object ConvertBack(object value, Type targetType, object parameter, strin throw new NotImplementedException(); } } -} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/TimeFormatConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/TimeFormatConverter.cs index 71f7f198..3b87cdef 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/TimeFormatConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/TimeFormatConverter.cs @@ -1,8 +1,7 @@ using System; using Microsoft.UI.Xaml.Data; -namespace SalmonEgg.Presentation.Converters -{ +namespace SalmonEgg.Presentation.Converters; /// /// 将 DateTime 转换为时间字符串格式 (HH:mm:ss) /// @@ -22,4 +21,3 @@ public object ConvertBack(object value, Type targetType, object parameter, strin throw new NotImplementedException(); } } -} diff --git a/SalmonEgg/SalmonEgg/Presentation/Views/GeneralSettingsPage.xaml.cs b/SalmonEgg/SalmonEgg/Presentation/Views/GeneralSettingsPage.xaml.cs index e1a2ed15..8a6c9422 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Views/GeneralSettingsPage.xaml.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Views/GeneralSettingsPage.xaml.cs @@ -1,8 +1,7 @@ using Microsoft.UI.Xaml.Controls; using SalmonEgg.Presentation.ViewModels.Settings; -namespace SalmonEgg.Presentation.Views -{ +namespace SalmonEgg.Presentation.Views; public sealed partial class GeneralSettingsPage : SettingsPageBase { public GeneralSettingsViewModel ViewModel { get; } @@ -14,4 +13,3 @@ public GeneralSettingsPage() SetSettingsBreadcrumbFromResource("SettingsNav_General.Content", "常规"); } } -} From 517ce80b745187de72d6089e0f3da124dad34491 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 16 May 2026 17:31:54 +0000 Subject: [PATCH 3/5] =?UTF-8?q?=F0=9F=94=92=20Security=20fix:=20prevent=20?= =?UTF-8?q?command=20injection=20in=20PlatformShellService?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🎯 **What:** The vulnerability fixed was a potential Command Injection in PlatformShellService due to unescaped arguments passed to `Process.Start()` when handling `open` or `xdg-open` commands on OSX and Linux respectively. ⚠️ **Risk:** If a malicious path containing shell metacharacters or flags was passed to these methods, it could lead to arbitrary command execution with the privileges of the application. 🛡️ **Solution:** Used `ProcessStartInfo` with `UseShellExecute = false` and `ArgumentList` to safely pass the path argument without shell expansion. Additionally, prepended `./` to paths starting with `-` to prevent argument injection flags. --- .../SalmonEgg/Controls/ChatSkeleton.xaml.cs | 25 +++++---- .../Converters/BoolToVisibilityConverter.cs | 55 ++++++++++--------- .../ConnectionStatusToColorConverter.cs | 43 ++++++++------- .../Converters/InverseBoolConverter.cs | 33 +++++------ .../Converters/InverseBooleanConverter.cs | 35 ++++++------ .../MessageDirectionToAlignmentConverter.cs | 31 ++++++----- .../MessageDirectionToBackgroundConverter.cs | 51 ++++++++--------- ...sageDirectionToBorderThicknessConverter.cs | 35 ++++++------ ...MessageDirectionToCornerRadiusConverter.cs | 35 ++++++------ .../MessageDirectionToForegroundConverter.cs | 51 ++++++++--------- .../Converters/MessageTemplateSelector.cs | 2 +- .../Converters/PlanStatusToColorConverter.cs | 41 +++++++------- .../Converters/TimeFormatConverter.cs | 29 +++++----- .../Views/GeneralSettingsPage.xaml.cs | 1 + SalmonEgg/SalmonEgg/SalmonEgg.csproj | 1 + 15 files changed, 241 insertions(+), 227 deletions(-) diff --git a/SalmonEgg/SalmonEgg/Controls/ChatSkeleton.xaml.cs b/SalmonEgg/SalmonEgg/Controls/ChatSkeleton.xaml.cs index 90e6a131..fa2836d6 100644 --- a/SalmonEgg/SalmonEgg/Controls/ChatSkeleton.xaml.cs +++ b/SalmonEgg/SalmonEgg/Controls/ChatSkeleton.xaml.cs @@ -2,18 +2,19 @@ using Microsoft.UI.Xaml.Controls; namespace SalmonEgg.Controls; - public sealed partial class ChatSkeleton : UserControl + +public sealed partial class ChatSkeleton : UserControl +{ + public ChatSkeleton() { - public ChatSkeleton() - { - InitializeComponent(); - Loaded += OnLoaded; - Unloaded += OnUnloaded; - } + InitializeComponent(); + Loaded += OnLoaded; + Unloaded += OnUnloaded; + } - private void OnLoaded(object sender, RoutedEventArgs e) - => ShimmerStoryboard.Begin(); + private void OnLoaded(object sender, RoutedEventArgs e) + => ShimmerStoryboard.Begin(); - private void OnUnloaded(object sender, RoutedEventArgs e) - => ShimmerStoryboard.Stop(); - } + private void OnUnloaded(object sender, RoutedEventArgs e) + => ShimmerStoryboard.Stop(); +} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/BoolToVisibilityConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/BoolToVisibilityConverter.cs index 80df2189..f08a706f 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/BoolToVisibilityConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/BoolToVisibilityConverter.cs @@ -3,38 +3,39 @@ using Microsoft.UI.Xaml.Data; namespace SalmonEgg.Presentation.Converters; - /// - /// 将布尔值转换为 Visibility - /// Requirements: 4.2 - /// - public class BoolToVisibilityConverter : IValueConverter + +/// +/// 将布尔值转换为 Visibility +/// Requirements: 4.2 +/// +public class BoolToVisibilityConverter : IValueConverter +{ + public object Convert(object value, Type targetType, object parameter, string language) { - public object Convert(object value, Type targetType, object parameter, string language) + if (value is bool boolValue) { - if (value is bool boolValue) - { - bool invert = parameter?.ToString() == "Invert"; - if (invert) boolValue = !boolValue; - return boolValue ? Visibility.Visible : Visibility.Collapsed; - } - - if (value is string stringValue) - { - return string.IsNullOrWhiteSpace(stringValue) ? Visibility.Collapsed : Visibility.Visible; - } - - return Visibility.Collapsed; + bool invert = parameter?.ToString() == "Invert"; + if (invert) boolValue = !boolValue; + return boolValue ? Visibility.Visible : Visibility.Collapsed; } - public object ConvertBack(object value, Type targetType, object parameter, string language) + if (value is string stringValue) { - if (value is Visibility visibility) - { - var result = visibility == Visibility.Visible; - var invert = parameter?.ToString() == "Invert"; - return invert ? !result : result; - } + return string.IsNullOrWhiteSpace(stringValue) ? Visibility.Collapsed : Visibility.Visible; + } - return false; + return Visibility.Collapsed; + } + + public object ConvertBack(object value, Type targetType, object parameter, string language) + { + if (value is Visibility visibility) + { + var result = visibility == Visibility.Visible; + var invert = parameter?.ToString() == "Invert"; + return invert ? !result : result; } + + return false; } +} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/ConnectionStatusToColorConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/ConnectionStatusToColorConverter.cs index e6dcd83a..5fbd4efe 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/ConnectionStatusToColorConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/ConnectionStatusToColorConverter.cs @@ -4,30 +4,31 @@ using SalmonEgg.Domain.Models; namespace SalmonEgg.Presentation.Converters; - /// - /// 将连接状态转换为颜色 - /// Requirements: 4.2 - /// - public class ConnectionStatusToColorConverter : IValueConverter + +/// +/// 将连接状态转换为颜色 +/// Requirements: 4.2 +/// +public class ConnectionStatusToColorConverter : IValueConverter +{ + public object Convert(object value, Type targetType, object parameter, string language) { - public object Convert(object value, Type targetType, object parameter, string language) + if (value is ConnectionStatus status) { - if (value is ConnectionStatus status) + return status switch { - return status switch - { - ConnectionStatus.Connected => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 34, 197, 94)), // Green - ConnectionStatus.Connecting => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 234, 179, 8)), // Yellow - ConnectionStatus.Reconnecting => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 249, 115, 22)),// Orange - ConnectionStatus.Error => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 239, 68, 68)), // Red - _ => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 156, 163, 175)) // Gray - }; - } - return new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 156, 163, 175)); + ConnectionStatus.Connected => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 34, 197, 94)), // Green + ConnectionStatus.Connecting => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 234, 179, 8)), // Yellow + ConnectionStatus.Reconnecting => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 249, 115, 22)),// Orange + ConnectionStatus.Error => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 239, 68, 68)), // Red + _ => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 156, 163, 175)) // Gray + }; } + return new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 156, 163, 175)); + } - public object ConvertBack(object value, Type targetType, object parameter, string language) - { - throw new NotImplementedException(); - } + public object ConvertBack(object value, Type targetType, object parameter, string language) + { + throw new NotImplementedException(); } +} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBoolConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBoolConverter.cs index 09b06bec..fb3f605d 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBoolConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBoolConverter.cs @@ -3,26 +3,27 @@ using Microsoft.UI.Xaml.Data; namespace SalmonEgg.Presentation.Converters; - /// - /// 将布尔值取反后转换为 Visibility - /// - public class InverseBoolConverter : IValueConverter + +/// +/// 将布尔值取反后转换为 Visibility +/// +public class InverseBoolConverter : IValueConverter +{ + public object Convert(object value, Type targetType, object parameter, string language) { - public object Convert(object value, Type targetType, object parameter, string language) + if (value is bool boolValue) { - if (value is bool boolValue) - { - return boolValue ? Visibility.Collapsed : Visibility.Visible; - } - return Visibility.Visible; + return boolValue ? Visibility.Collapsed : Visibility.Visible; } + return Visibility.Visible; + } - public object ConvertBack(object value, Type targetType, object parameter, string language) + public object ConvertBack(object value, Type targetType, object parameter, string language) + { + if (value is Visibility visibility) { - if (value is Visibility visibility) - { - return visibility == Visibility.Collapsed; - } - return true; + return visibility == Visibility.Collapsed; } + return true; } +} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBooleanConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBooleanConverter.cs index 8a7d9eae..bcae5098 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBooleanConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/InverseBooleanConverter.cs @@ -2,27 +2,28 @@ using Microsoft.UI.Xaml.Data; namespace SalmonEgg.Presentation.Converters; - /// - /// 将布尔值取反(返回 bool,不是 Visibility) - /// 用于 IsEnabled 等需要 bool 的属性 - /// - public class InverseBooleanConverter : IValueConverter + +/// +/// 将布尔值取反(返回 bool,不是 Visibility) +/// 用于 IsEnabled 等需要 bool 的属性 +/// +public class InverseBooleanConverter : IValueConverter +{ + public object Convert(object value, Type targetType, object parameter, string language) { - public object Convert(object value, Type targetType, object parameter, string language) + if (value is bool boolValue) { - if (value is bool boolValue) - { - return !boolValue; - } - return true; + return !boolValue; } + return true; + } - public object ConvertBack(object value, Type targetType, object parameter, string language) + public object ConvertBack(object value, Type targetType, object parameter, string language) + { + if (value is bool boolValue) { - if (value is bool boolValue) - { - return !boolValue; - } - return false; + return !boolValue; } + return false; } +} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToAlignmentConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToAlignmentConverter.cs index 4c87dae6..0add733d 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToAlignmentConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToAlignmentConverter.cs @@ -3,23 +3,24 @@ using Microsoft.UI.Xaml.Data; namespace SalmonEgg.Presentation.Converters; - /// - /// 将消息方向转换为对齐方式 - /// Requirements: 4.2 - /// - public class MessageDirectionToAlignmentConverter : IValueConverter + +/// +/// 将消息方向转换为对齐方式 +/// Requirements: 4.2 +/// +public class MessageDirectionToAlignmentConverter : IValueConverter +{ + public object Convert(object value, Type targetType, object parameter, string language) { - public object Convert(object value, Type targetType, object parameter, string language) + if (value is bool isOutgoing) { - if (value is bool isOutgoing) - { - return isOutgoing ? HorizontalAlignment.Right : HorizontalAlignment.Left; - } - return HorizontalAlignment.Left; + return isOutgoing ? HorizontalAlignment.Right : HorizontalAlignment.Left; } + return HorizontalAlignment.Left; + } - public object ConvertBack(object value, Type targetType, object parameter, string language) - { - throw new NotImplementedException(); - } + public object ConvertBack(object value, Type targetType, object parameter, string language) + { + throw new NotImplementedException(); } +} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBackgroundConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBackgroundConverter.cs index 72249f81..1ae8e53a 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBackgroundConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBackgroundConverter.cs @@ -4,39 +4,40 @@ using Microsoft.UI.Xaml.Media; namespace SalmonEgg.Presentation.Converters; - /// - /// 将消息方向转换为背景色画刷 - /// 用户发出(True)返回 AccentFillColorDefaultBrush - /// AI接收(False)返回 CardBackgroundFillColorDefaultBrush - /// - public class MessageDirectionToBackgroundConverter : IValueConverter + +/// +/// 将消息方向转换为背景色画刷 +/// 用户发出(True)返回 AccentFillColorDefaultBrush +/// AI接收(False)返回 CardBackgroundFillColorDefaultBrush +/// +public class MessageDirectionToBackgroundConverter : IValueConverter +{ + public object Convert(object value, Type targetType, object parameter, string language) { - public object Convert(object value, Type targetType, object parameter, string language) + if (value is bool isOutgoing) { - if (value is bool isOutgoing) + if (isOutgoing) { - if (isOutgoing) + if (Microsoft.UI.Xaml.Application.Current.Resources.TryGetValue("AccentFillColorDefaultBrush", out var accentBrush)) { - if (Microsoft.UI.Xaml.Application.Current.Resources.TryGetValue("AccentFillColorDefaultBrush", out var accentBrush)) - { - return accentBrush; - } + return accentBrush; } - else + } + else + { + if (Microsoft.UI.Xaml.Application.Current.Resources.TryGetValue("ControlFillColorSecondaryBrush", out var cardBrush)) { - if (Microsoft.UI.Xaml.Application.Current.Resources.TryGetValue("ControlFillColorSecondaryBrush", out var cardBrush)) - { - return cardBrush; - } + return cardBrush; } } - - // Fallback - return Microsoft.UI.Xaml.Application.Current.Resources["LayerOnAcrylicFillColorDefaultBrush"]; } - public object ConvertBack(object value, Type targetType, object parameter, string language) - { - throw new NotImplementedException(); - } + // Fallback + return Microsoft.UI.Xaml.Application.Current.Resources["LayerOnAcrylicFillColorDefaultBrush"]; + } + + public object ConvertBack(object value, Type targetType, object parameter, string language) + { + throw new NotImplementedException(); } +} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBorderThicknessConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBorderThicknessConverter.cs index fed9c68d..2240c57a 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBorderThicknessConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToBorderThicknessConverter.cs @@ -3,25 +3,26 @@ using Microsoft.UI.Xaml.Data; namespace SalmonEgg.Presentation.Converters; - /// - /// 将消息方向转换为边框粗细 - /// 用户发出(True)返回 0 (无边框,颜色深不需要) - /// AI接收(False)返回 1 (浅色模式下需要边框建立层级感) - /// - public class MessageDirectionToBorderThicknessConverter : IValueConverter + +/// +/// 将消息方向转换为边框粗细 +/// 用户发出(True)返回 0 (无边框,颜色深不需要) +/// AI接收(False)返回 1 (浅色模式下需要边框建立层级感) +/// +public class MessageDirectionToBorderThicknessConverter : IValueConverter +{ + public object Convert(object value, Type targetType, object parameter, string language) { - public object Convert(object value, Type targetType, object parameter, string language) + if (value is bool isOutgoing) { - if (value is bool isOutgoing) - { - // AI 消息返回 1,用户消息返回 0 - return isOutgoing ? new Thickness(0) : new Thickness(1); - } - return new Thickness(0); + // AI 消息返回 1,用户消息返回 0 + return isOutgoing ? new Thickness(0) : new Thickness(1); } + return new Thickness(0); + } - public object ConvertBack(object value, Type targetType, object parameter, string language) - { - throw new NotImplementedException(); - } + public object ConvertBack(object value, Type targetType, object parameter, string language) + { + throw new NotImplementedException(); } +} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToCornerRadiusConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToCornerRadiusConverter.cs index 80a9c9d0..d1841a9f 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToCornerRadiusConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToCornerRadiusConverter.cs @@ -3,25 +3,26 @@ using Microsoft.UI.Xaml.Data; namespace SalmonEgg.Presentation.Converters; - /// - /// 将消息方向转换为气泡的非对称圆角 - /// 用户发出(True)为右下直角,左下圆角 - /// AI接收(False)为左下直角,右下圆角 - /// - public class MessageDirectionToCornerRadiusConverter : IValueConverter + +/// +/// 将消息方向转换为气泡的非对称圆角 +/// 用户发出(True)为右下直角,左下圆角 +/// AI接收(False)为左下直角,右下圆角 +/// +public class MessageDirectionToCornerRadiusConverter : IValueConverter +{ + public object Convert(object value, Type targetType, object parameter, string language) { - public object Convert(object value, Type targetType, object parameter, string language) + if (value is bool isOutgoing) { - if (value is bool isOutgoing) - { - // 左上, 右上, 右下, 左下 - return isOutgoing ? new CornerRadius(12, 12, 0, 12) : new CornerRadius(12, 12, 12, 0); - } - return new CornerRadius(12); + // 左上, 右上, 右下, 左下 + return isOutgoing ? new CornerRadius(12, 12, 0, 12) : new CornerRadius(12, 12, 12, 0); } + return new CornerRadius(12); + } - public object ConvertBack(object value, Type targetType, object parameter, string language) - { - throw new NotImplementedException(); - } + public object ConvertBack(object value, Type targetType, object parameter, string language) + { + throw new NotImplementedException(); } +} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToForegroundConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToForegroundConverter.cs index 620947ff..bdedd40d 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToForegroundConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageDirectionToForegroundConverter.cs @@ -4,39 +4,40 @@ using Microsoft.UI.Xaml.Media; namespace SalmonEgg.Presentation.Converters; - /// - /// 将消息方向转换为前景色(文本色)画刷 - /// 用户发出(True)返回 TextOnAccentFillColorPrimaryBrush - /// AI接收(False)返回 TextFillColorPrimaryBrush - /// - public class MessageDirectionToForegroundConverter : IValueConverter + +/// +/// 将消息方向转换为前景色(文本色)画刷 +/// 用户发出(True)返回 TextOnAccentFillColorPrimaryBrush +/// AI接收(False)返回 TextFillColorPrimaryBrush +/// +public class MessageDirectionToForegroundConverter : IValueConverter +{ + public object Convert(object value, Type targetType, object parameter, string language) { - public object Convert(object value, Type targetType, object parameter, string language) + if (value is bool isOutgoing) { - if (value is bool isOutgoing) + if (isOutgoing) { - if (isOutgoing) + if (Microsoft.UI.Xaml.Application.Current.Resources.TryGetValue("TextOnAccentFillColorPrimaryBrush", out var textOnAccent)) { - if (Microsoft.UI.Xaml.Application.Current.Resources.TryGetValue("TextOnAccentFillColorPrimaryBrush", out var textOnAccent)) - { - return textOnAccent; - } + return textOnAccent; } - else + } + else + { + if (Microsoft.UI.Xaml.Application.Current.Resources.TryGetValue("TextFillColorPrimaryBrush", out var textPrimary)) { - if (Microsoft.UI.Xaml.Application.Current.Resources.TryGetValue("TextFillColorPrimaryBrush", out var textPrimary)) - { - return textPrimary; - } + return textPrimary; } } - - // Fallback - return Microsoft.UI.Xaml.Application.Current.Resources["TextFillColorPrimaryBrush"]; } - public object ConvertBack(object value, Type targetType, object parameter, string language) - { - throw new NotImplementedException(); - } + // Fallback + return Microsoft.UI.Xaml.Application.Current.Resources["TextFillColorPrimaryBrush"]; + } + + public object ConvertBack(object value, Type targetType, object parameter, string language) + { + throw new NotImplementedException(); } +} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageTemplateSelector.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageTemplateSelector.cs index 28ff6982..796a8ae5 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/MessageTemplateSelector.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/MessageTemplateSelector.cs @@ -1,6 +1,6 @@ +using System; using Microsoft.UI.Xaml; using Microsoft.UI.Xaml.Controls; -using System; using SalmonEgg.Presentation.ViewModels.Chat; namespace SalmonEgg.Presentation.Converters; diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/PlanStatusToColorConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/PlanStatusToColorConverter.cs index 66d8fcd2..265e7945 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/PlanStatusToColorConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/PlanStatusToColorConverter.cs @@ -5,29 +5,30 @@ using SalmonEgg.Domain.Models.Plan; namespace SalmonEgg.Presentation.Converters; - /// - /// 将计划条目状态转换为对应的颜色 - /// - public class PlanStatusToColorConverter : IValueConverter + +/// +/// 将计划条目状态转换为对应的颜色 +/// +public class PlanStatusToColorConverter : IValueConverter +{ + public object Convert(object value, Type targetType, object parameter, string language) { - public object Convert(object value, Type targetType, object parameter, string language) + if (value is PlanEntryStatus status) { - if (value is PlanEntryStatus status) + return status switch { - return status switch - { - PlanEntryStatus.Pending => new SolidColorBrush(Microsoft.UI.Colors.Gray), - PlanEntryStatus.InProgress => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 0, 120, 215)), - PlanEntryStatus.Completed => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 0, 180, 0)), - PlanEntryStatus.Failed => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 200, 40, 40)), - _ => new SolidColorBrush(Microsoft.UI.Colors.Gray) - }; - } - return new SolidColorBrush(Microsoft.UI.Colors.Gray); + PlanEntryStatus.Pending => new SolidColorBrush(Microsoft.UI.Colors.Gray), + PlanEntryStatus.InProgress => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 0, 120, 215)), + PlanEntryStatus.Completed => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 0, 180, 0)), + PlanEntryStatus.Failed => new SolidColorBrush(Microsoft.UI.ColorHelper.FromArgb(255, 200, 40, 40)), + _ => new SolidColorBrush(Microsoft.UI.Colors.Gray) + }; } + return new SolidColorBrush(Microsoft.UI.Colors.Gray); + } - public object ConvertBack(object value, Type targetType, object parameter, string language) - { - throw new NotImplementedException(); - } + public object ConvertBack(object value, Type targetType, object parameter, string language) + { + throw new NotImplementedException(); } +} diff --git a/SalmonEgg/SalmonEgg/Presentation/Converters/TimeFormatConverter.cs b/SalmonEgg/SalmonEgg/Presentation/Converters/TimeFormatConverter.cs index 3b87cdef..950767ed 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Converters/TimeFormatConverter.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Converters/TimeFormatConverter.cs @@ -2,22 +2,23 @@ using Microsoft.UI.Xaml.Data; namespace SalmonEgg.Presentation.Converters; - /// - /// 将 DateTime 转换为时间字符串格式 (HH:mm:ss) - /// - public class TimeFormatConverter : IValueConverter + +/// +/// 将 DateTime 转换为时间字符串格式 (HH:mm:ss) +/// +public class TimeFormatConverter : IValueConverter +{ + public object Convert(object value, Type targetType, object parameter, string language) { - public object Convert(object value, Type targetType, object parameter, string language) + if (value is DateTime dateTime) { - if (value is DateTime dateTime) - { - return dateTime.ToString("HH:mm:ss"); - } - return string.Empty; + return dateTime.ToString("HH:mm:ss"); } + return string.Empty; + } - public object ConvertBack(object value, Type targetType, object parameter, string language) - { - throw new NotImplementedException(); - } + public object ConvertBack(object value, Type targetType, object parameter, string language) + { + throw new NotImplementedException(); } +} diff --git a/SalmonEgg/SalmonEgg/Presentation/Views/GeneralSettingsPage.xaml.cs b/SalmonEgg/SalmonEgg/Presentation/Views/GeneralSettingsPage.xaml.cs index 8a6c9422..80a98fac 100644 --- a/SalmonEgg/SalmonEgg/Presentation/Views/GeneralSettingsPage.xaml.cs +++ b/SalmonEgg/SalmonEgg/Presentation/Views/GeneralSettingsPage.xaml.cs @@ -2,6 +2,7 @@ using SalmonEgg.Presentation.ViewModels.Settings; namespace SalmonEgg.Presentation.Views; + public sealed partial class GeneralSettingsPage : SettingsPageBase { public GeneralSettingsViewModel ViewModel { get; } diff --git a/SalmonEgg/SalmonEgg/SalmonEgg.csproj b/SalmonEgg/SalmonEgg/SalmonEgg.csproj index a40ec36c..b26d30fd 100644 --- a/SalmonEgg/SalmonEgg/SalmonEgg.csproj +++ b/SalmonEgg/SalmonEgg/SalmonEgg.csproj @@ -1,5 +1,6 @@ + true BrowserWasm false browser-wasm From d3cb92303d8989a19832bf3fa96bba0937b92525 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 16 May 2026 18:12:51 +0000 Subject: [PATCH 4/5] =?UTF-8?q?=F0=9F=94=92=20Security=20fix:=20prevent=20?= =?UTF-8?q?command=20injection=20in=20PlatformShellService?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🎯 **What:** The vulnerability fixed was a potential Command Injection in PlatformShellService due to unescaped arguments passed to `Process.Start()` when handling `open` or `xdg-open` commands on OSX and Linux respectively. ⚠️ **Risk:** If a malicious path containing shell metacharacters or flags was passed to these methods, it could lead to arbitrary command execution with the privileges of the application. 🛡️ **Solution:** Used `ProcessStartInfo` with `UseShellExecute = false` and `ArgumentList` to safely pass the path argument without shell expansion. Additionally, prepended `./` to paths starting with `-` to prevent argument injection flags. --- .github/workflows/ci-core.yml | 3 --- .github/workflows/code-quality.yml | 3 --- .../SalmonEgg.Presentation.Core.Tests.csproj | 1 + 3 files changed, 1 insertion(+), 6 deletions(-) diff --git a/.github/workflows/ci-core.yml b/.github/workflows/ci-core.yml index 884a62f7..4eedb610 100644 --- a/.github/workflows/ci-core.yml +++ b/.github/workflows/ci-core.yml @@ -26,9 +26,6 @@ jobs: with: dotnet-version: ${{ env.DOTNET_VERSION }} - - name: Install wasm-tools workload - run: dotnet workload install wasm-tools - - name: Restore dependencies run: dotnet restore SalmonEgg.sln diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml index 035b2876..c4dd5ae3 100644 --- a/.github/workflows/code-quality.yml +++ b/.github/workflows/code-quality.yml @@ -25,9 +25,6 @@ jobs: with: dotnet-version: ${{ env.DOTNET_VERSION }} - - name: Install wasm-tools workload - run: dotnet workload install wasm-tools - - name: Restore dependencies run: dotnet restore SalmonEgg.sln diff --git a/tests/SalmonEgg.Presentation.Core.Tests/SalmonEgg.Presentation.Core.Tests.csproj b/tests/SalmonEgg.Presentation.Core.Tests/SalmonEgg.Presentation.Core.Tests.csproj index 7ee9a2af..b9e81011 100644 --- a/tests/SalmonEgg.Presentation.Core.Tests/SalmonEgg.Presentation.Core.Tests.csproj +++ b/tests/SalmonEgg.Presentation.Core.Tests/SalmonEgg.Presentation.Core.Tests.csproj @@ -1,5 +1,6 @@ + true net10.0 enable enable From 6326933195b970a664513c301fdfc66ed5ea017a Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Thu, 25 Jun 2026 13:25:54 +0000 Subject: [PATCH 5/5] =?UTF-8?q?=F0=9F=94=92=20Security=20fix:=20prevent=20?= =?UTF-8?q?command=20injection=20in=20PlatformShellService?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🎯 **What:** The vulnerability fixed was a potential Command Injection in PlatformShellService due to unescaped arguments passed to `Process.Start()` when handling `open` or `xdg-open` commands on OSX and Linux respectively. ⚠️ **Risk:** If a malicious path containing shell metacharacters or flags was passed to these methods, it could lead to arbitrary command execution with the privileges of the application. 🛡️ **Solution:** Used `ProcessStartInfo` with `UseShellExecute = false` and `ArgumentList` to safely pass the path argument without shell expansion. Additionally, prepended `./` to paths starting with `-` to prevent argument injection flags.