IJHack / QtPass / 35463508362

93%

Build Type

push

github

Committed by web-flow

Commit Message

Terminate option parsing before every path handed to git or gpg (#1847)

git add/rm/mv/commit and gpg's positional inputs (decrypt, list-only,
verify, detach-sign) get a "--" in front of the path, as the .gpg-id
commit and the ls-files check already did. The paths QtPass builds are
absolute, so nothing was exploitable; the rule is now visible in one
glance instead of proven per call site.


Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Coverage Stats

11 of 13 new or added lines in 2 files covered. (84.62%)

2 existing lines in 2 files now uncovered.

6783 of 8702 relevant lines covered (77.95%)

74.55 hits per line