runBrew built a command string and ran it through zsh -c, so the shell interpreted the whole line — any metacharacter in an interpolated package name (;, $(), backticks) would have been executed. Names come from brew itself so exploitation was unlikely, but the injection class is now gone: Process gets an argument array via /usr/bin/env, which resolves brew on PATH (covering the bare "brew" fallback) and execs it with no shell in between. Also slightly faster per invocation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .claude/skills | ||
| asset | ||
| BrewBar | ||
| BrewBar.xcodeproj | ||
| BrewBarTests | ||
| .gitignore | ||
| .swiftlint.yml | ||
| LICENSE | ||
| README.md | ||