aelassas / servy / 25391032506

88%

main: 88%

Build Type

push

github

Committed by aelassas

Commit Message

fix(core): SecurityHelper.cs - CreateSecureDirectory does not purge non-listed explicit ACEs; pre-existing or attacker-created directory retains foreign Full-Control grants
fix(desktop,manager): AppBootstrapper.cs - When OnStartup calls app.Shutdown() for security/SQLite checks, caller still proceeds to StartAvailabilityMonitor + InitializeAppWithFaultHandlingAsync
fix(desktop,manager): AppBootstrapper.cs - ProtectedKeyProvider created and never disposed; cached AES key material lingers in heap until GC
ci(sonar): sonar.yml - Missing top-level permissions block leaves GITHUB_TOKEN at repo defaults; PR trigger silently commented out
fix(psm1): Invoke-ServyCli scrubs stderr (success path) and both streams (catch path) but leaves success-path stdout unscrubbed
fix(core): SecureData.cs - IDisposable class holding raw AES/HMAC keys has no finalizer; forgotten Dispose leaves key material unwiped until GC
fix(core): ProtectedKeyProvider.cs - IDisposable holding decrypted AES key/IV has no finalizer; forgotten Dispose leaves plaintext key material in managed heap until GC
fix(core): EnvironmentVariableHelper.cs - ProtectedVariables list omits DOTNET_ROOT, DOTNET_HOST_PATH, DOTNET_BUNDLE_EXTRACT_BASE_DIR — .NET runtime hijacking via env var override
fix(notifications): ServySecurity.ps1 - Protect-SensitiveString claims parity with C# MaskingRegex but is missing the space-separator and '/' branches; secrets in CLI args leak into email/toast notifications
fix(core): ProtectedKeyProvider.cs - GetCachedOrGenerate fast-path reads cacheField without synchronization; race with InvalidateCache can NRE on Clone()

Coverage Stats

1104 of 1915 branches covered (57.65%)

Branch coverage included in aggregate %.

27 of 48 new or added lines in 7 files covered. (56.25%)

334 existing lines in 6 files now uncovered.

8072 of 15155 relevant lines covered (53.26%)

381.3 hits per line