Dylan M. Taylor ec653f8a91 xtask serve, macOS cert import, audio probe test, Ease Presets: confine paths and temp files ...

serve_dir stripped '..' and leading slashes but could still be steered
outside the dist folder ('/..//etc/passwd' left '//etc/passwd', which
join treats as absolute); it now keeps only normal path components. Each
connection's thread blocked forever on a silent client and thread creation
failure panicked; reads now time out and a failed spawn drops the
connection. import-cert.sh wrote the signing bundle to a predictable path
that another user could pre-create; mktemp makes it new and private. The
audio probe test trusted a predictable, possibly pre-existing scratch dir
for executables on PATH; it now creates a fresh private one. Ease Presets
looked up each loaded preset name in the whole list (quadratic); a name
set replaces it.

2026-11-03 11:33:04 +00:00

..

scriptui-panels

xtask serve, macOS cert import, audio probe test, Ease Presets: confine paths and temp files

2026-11-03 11:33:04 +00:00