David Dworken and GitHub
263993d836
Use env vars for workflow_run context values in example workflows ( #1125 )
...
* Use env vars for workflow_run context values in example workflows
* Add security note to ci-failure-auto-fix example about trust requirements
2026-04-04 20:10:11 -07:00
David Dworken and GitHub
1ba15be4f0
Remove redundant git status/diff/log from tag mode allowlist ( #1075 )
2026-03-18 09:06:33 -07:00
David Dworken and GitHub
64c7a0ef71
Only expose permission_denials count in sanitized output ( #993 )
2026-03-02 09:21:16 +00:00
220272d388
Change the default display_report option to false to restrict exposed data ( #992 )
...
* Change the default `display_report` option to false to restrict exposed data
* Update action.yml
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
2026-03-01 21:57:53 -08:00
David Dworken and GitHub
f09dc9a6a3
fix: use original body from webhook payload for TOCTOU hardening ( #904 )
...
* fix: use original body from webhook payload for TOCTOU hardening
* test: add null originalBody + edited GraphQL body TOCTOU scenario
2026-02-05 10:54:51 -08:00
5da7ba548c
feat: add path validation for commit_files MCP tool ( #796 )
...
Add validatePathWithinRepo helper to ensure file paths resolve within the repository root directory. This hardens the commit_files tool by validating paths before file operations.
Changes:
- Add src/mcp/path-validation.ts with async path validation using realpath
- Update commit_files to validate all paths before reading files
- Prevent symlink-based path escapes by resolving real paths
- Add comprehensive test coverage including symlink attack scenarios
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-authored-by: Claude <noreply@anthropic.com >
2026-01-07 10:16:31 -08:00
56c8ae7d88
Add show_full_output option to control output verbosity ( #580 )
...
* Add show_full_output option to control output verbosity
* Update base-action/src/run-claude.ts
Co-authored-by: Ashwin Bhat <ashwin@anthropic.com >
* Wire show_full_output through to base-action
* Document show_full_output security warnings in docs/security.md
---------
Co-authored-by: Ashwin Bhat <ashwin@anthropic.com >
2025-10-28 11:52:18 -07:00
David Dworken and GitHub
00b4a23551
fix: prevent command injection in git hash-object call ( #297 )
...
* Update package name to reference under the @Anthropic-AI NPM org
* fix: prevent command injection in git hash-object call
* Revert accidental change
2025-07-18 09:58:22 -07:00
