torrentclaw/torrentclaw-skill
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): eliminate shell injection and add input validation

Browse source 
Replace unsafe string interpolation in aria2 RPC JSON construction
with jq --arg for proper escaping. Add magnet URL format validation
to reject arbitrary input. Refactor detect-client.sh JSON output
to use jq. Add CI security check to prevent regression.

Resolves VirusTotal "Suspicious" classification caused by the
shell injection vulnerability in add-torrent.sh.
This commit is contained in:
Deivid Soto 2026-02-15 10:46:34 +01:00
parent 5d409c4a66
commit d3d6c702ed
6 changed files with 73 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -1,6 +1,6 @@
# torrentclaw-skill
**Version:** 0.1.13
**Version:** 0.1.16
**License:** MIT
**Homepage:** https://torrentclaw.com