From 7f82974496656988afb804b28aead4128639042b Mon Sep 17 00:00:00 2001 From: ShadowDara Date: Tue, 8 Sep 2026 22:11:46 +0200 Subject: [PATCH 1/5] Create SECURITY.md --- SECURITY.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..034e8480 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,21 @@ +# Security Policy + +## Supported Versions + +Use this section to tell people about which versions of your project are +currently being supported with security updates. + +| Version | Supported | +| ------- | ------------------ | +| 5.1.x | :white_check_mark: | +| 5.0.x | :x: | +| 4.0.x | :white_check_mark: | +| < 4.0 | :x: | + +## Reporting a Vulnerability + +Use this section to tell people how to report a vulnerability. + +Tell them where to go, how often they can expect to get an update on a +reported vulnerability, what to expect if the vulnerability is accepted or +declined, etc. From 3a9ffd355b36e15b2707f4b7a098955b876cb0c9 Mon Sep 17 00:00:00 2001 From: ShadowDara Date: Tue, 8 Sep 2026 23:11:29 +0200 Subject: [PATCH 2/5] Update .gitattributes --- .gitattributes | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.gitattributes b/.gitattributes index 5dfdb26f..67c65a2a 100644 --- a/.gitattributes +++ b/.gitattributes @@ -9,18 +9,21 @@ # mark samfile as shell samfile linguist-language=Shell -go.work linguist-language=Shell -go.mod linguist-language=Shell +go.work linguist-language=go +go.mod linguist-language=go # HTML DIR /cmd/findergen/frontend/** linguist-vendored -/finder-template-generator-ssg/size-plugin.ts linguist-vendored +/finder-template-generator-ssg/md-linter-plugin.ts linguist-vendored +/finder-template-generator-ssg/vite-pluginbuild-stats.ts linguist-vendored /finder-template-generator-ssg/pages-ssg-plugin.ts linguist-vendored + /finder-template-generator-ssg/src/jsx-runtime.ts linguist-vendored /finder-template-generator-ssg/src/jsx.d.ts linguist-vendored /finder-template-generator-ssg/src/templates.js linguist-vendored -/finder-template-generator-ssg/public/install.sh + +/finder-template-generator-ssg/public/install.sh linguist-vendored /.obsidian/** linguist-vendored From 9609fc1f3b2126806c7fab29bb364fd086d28d9e Mon Sep 17 00:00:00 2001 From: ShadowDara Date: Tue, 8 Sep 2026 23:22:35 +0200 Subject: [PATCH 3/5] Update .gitattributes --- .gitattributes | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitattributes b/.gitattributes index 67c65a2a..3921ac52 100644 --- a/.gitattributes +++ b/.gitattributes @@ -19,6 +19,7 @@ go.mod linguist-language=go /finder-template-generator-ssg/vite-pluginbuild-stats.ts linguist-vendored /finder-template-generator-ssg/pages-ssg-plugin.ts linguist-vendored +/finder-template-generator-ssg/src/pages.d.ts linguist-vendored /finder-template-generator-ssg/src/jsx-runtime.ts linguist-vendored /finder-template-generator-ssg/src/jsx.d.ts linguist-vendored From 810b2b4f1e88aa129fa10925e2be767734d5b06a Mon Sep 17 00:00:00 2001 From: ShadowDara Date: Wed, 9 Sep 2026 16:23:56 +0200 Subject: [PATCH 4/5] Potential fix for code scanning alert no. 4: Prototype-polluting function Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- finder-template-generator-ssg/src/configeditor/editor.tsx | 3 +++ 1 file changed, 3 insertions(+) diff --git a/finder-template-generator-ssg/src/configeditor/editor.tsx b/finder-template-generator-ssg/src/configeditor/editor.tsx index 37863eb7..d2ed7635 100644 --- a/finder-template-generator-ssg/src/configeditor/editor.tsx +++ b/finder-template-generator-ssg/src/configeditor/editor.tsx @@ -117,6 +117,9 @@ export function setupConfigEditor( function setPath(obj: any, path: string, value: unknown) { const parts = path.split("."); + const blockedKeys = new Set(["__proto__", "constructor", "prototype"]); + if (parts.some((part) => blockedKeys.has(part))) return; + let cur = obj; for (let i = 0; i < parts.length - 1; i++) { const p = parts[i]; From 6a579fc80bf50b5de8f8068a9f41ecf0afd3388e Mon Sep 17 00:00:00 2001 From: ShadowDara Date: Wed, 9 Sep 2026 16:29:10 +0200 Subject: [PATCH 5/5] Potential fix for code scanning alert no. 5: Prototype-polluting function Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .../src/configeditor/mount.ts | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/finder-template-generator-ssg/src/configeditor/mount.ts b/finder-template-generator-ssg/src/configeditor/mount.ts index 75e77653..33999666 100644 --- a/finder-template-generator-ssg/src/configeditor/mount.ts +++ b/finder-template-generator-ssg/src/configeditor/mount.ts @@ -31,13 +31,26 @@ export function initConfigEditor( function setPath(obj: any, path: string, value: unknown) { const parts = path.split("."); + const isUnsafeKey = (key: string) => + key === "__proto__" || key === "constructor" || key === "prototype"; + let cur = obj; for (let i = 0; i < parts.length - 1; i++) { const p = parts[i]; + if (isUnsafeKey(p)) { + throw new Error(`initConfigEditor: Unsicherer Pfad-Segmentname "${p}".`); + } if (typeof cur[p] !== "object" || cur[p] === null) cur[p] = {}; cur = cur[p]; } - cur[parts[parts.length - 1]] = value; + + const last = parts[parts.length - 1]; + if (isUnsafeKey(last)) { + throw new Error( + `initConfigEditor: Unsicherer finaler Pfad-Segmentname "${last}".`, + ); + } + cur[last] = value; } function readField(