mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-24 16:01:42 +00:00

Files

T

Ruben Fiszel 6acce7a887 fix(powershell): sanitize module names to prevent command injection (CWE-78) (#9587 )

Module names parsed from user-supplied lock content (parse_modules_json)
and script imports (parse_script_imports) were interpolated directly into
PowerShell single-quoted string literals when building the module install
command, with no escaping or validation. A module name containing a single
quote could break out of the literal and execute arbitrary PowerShell.

Two-layer fix:
- Validate module names against ^[a-zA-Z0-9._-]+$. parse_modules_json
  rejects invalid names with an error; parse_script_imports skips them
  with a warning.
- Defense-in-depth: escape single quotes (' -> '') on both name and
  version before interpolating into the install hashtable literals,
  mirroring val_to_pwsh_param.

Fixes WIN-2049

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-15 16:20:20 +02:00

nsjail

fix(nsjail): make ansible collections mount non-mandatory (#9510 )

2026-06-10 12:54:34 +00:00

src

fix(powershell): sanitize module names to prevent command injection (CWE-78) (#9587 )

2026-06-15 16:20:20 +02:00

build.rs

refactor: isolate deno_core into windmill-runtime-nativets subcrate (#7848 )

2026-02-08 09:16:37 +00:00

Cargo.toml

fix: actually isolate windows job children from CTRL_BREAK_EVENT + reap on worker death (#9563 )