You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+16Lines changed: 16 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -2,6 +2,22 @@
2
2
3
3
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
#### [#55](https://github.com/davewasmer/devcert/pull/55): Fix remote execution vulnerability by switching from execSync to execFileSync
11
+
12
+
- Change `run()` to use `execFileSync`
13
+
- Refactor codebase to use new signature of `run()`
14
+
- Add an extra sanitizing step: test arguments passed to `certificateFor` with a (fairly permissive) regular expression limiting them to legal domain name chars
15
+
16
+
### ⚠️ This is a mandatory update! ⚠️
17
+
18
+
This release fixes a security vulnerability in previous versions. Previous versions will be deprecated.
0 commit comments