You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cordova.apache.org by ma...@apache.org on 2026/07/29 18:57:44 UTC
(cordova-paramedic) branch master updated (a18c0a5 -> 13ddd8b)
This is an automated email from the ASF dual-hosted git repository.
GitToTheHub pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/cordova-paramedic.git
from a18c0a5 chore(workflow): update workflows & configs (#312)
add 0d4bf75 fix: V-001 security vulnerability
add 868dbe4 chore: revert logger.warn to template literals
add a77e6f4 chore: use template literals for SQL strings
new 13ddd8b chore(ios-permissions): defensive SQL escaping for TCC permission updates
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
lib/ParamediciOSPermissions.js | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org
(cordova-paramedic) 01/01: chore(ios-permissions): defensive SQL escaping for TCC permission updates
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
GitToTheHub pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cordova-paramedic.git
commit 13ddd8bc4dd06999c90731d4e462f1e98eb2094c
Merge: a18c0a5 a77e6f4
Author: Manuel Beck <ma...@outlook.de>
AuthorDate: Wed Jul 29 20:57:39 2026 +0200
chore(ios-permissions): defensive SQL escaping for TCC permission updates
- The ParamediciOSPermissions.js module constructs SQL INSERT and UPDATE statements using template literal string interpolation with the ${service} and ${app} variables. These variables are passed to the sqlite3 command-line tool without parameterisation or escaping, allowing SQL injection if an attacker controls these parameters.
- Automated security fix generated by OrbisAI Security
Generated-By: Claude Sonnet 4.6
lib/ParamediciOSPermissions.js | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org