1. 01 Oct, 2018 1 commit
  2. 19 Sep, 2018 1 commit
  3. 22 Aug, 2018 2 commits
    • Andrew Clark's avatar
      Use file name whitelist to prevent RCE (#4866) · 24b101d2
      Andrew Clark authored
      * Use file name whitelist to prevent RCE
      
      Use a whitelist to validate user-provided file names. This doesn't cover
      the entire range of valid filenames but should cover almost all of them
      in practice. Allows letters, numbers, periods, dashes, and underscores.
      Opting to use a whitelist instead of a blacklist because getting this
      wrong leaves us vulnerable to a RCE attack.
      
      * Allow alphabet characters from all languages
      
      Updated the whitelist to /^[\p{L}0-9/.\-_]+$/u, which matches
      alphanumeric characters, periods, dashes, and underscores. Unicode
      property support is stage 4 so I've inlined the transpiled version.
      
      * Only use file name whitelist on Windows
      
      * Log error message if file name does not pass whitelist
      24b101d2
    • Andrew Clark's avatar
      Use file name whitelist to prevent RCE (#4866) · 577a274d
      Andrew Clark authored
      * Use file name whitelist to prevent RCE
      
      Use a whitelist to validate user-provided file names. This doesn't cover
      the entire range of valid filenames but should cover almost all of them
      in practice. Allows letters, numbers, periods, dashes, and underscores.
      Opting to use a whitelist instead of a blacklist because getting this
      wrong leaves us vulnerable to a RCE attack.
      
      * Allow alphabet characters from all languages
      
      Updated the whitelist to /^[\p{L}0-9/.\-_]+$/u, which matches
      alphanumeric characters, periods, dashes, and underscores. Unicode
      property support is stage 4 so I've inlined the transpiled version.
      
      * Only use file name whitelist on Windows
      
      * Log error message if file name does not pass whitelist
      577a274d
  4. 05 Feb, 2018 1 commit
  5. 17 Jan, 2018 1 commit
  6. 09 Jan, 2018 4 commits
  7. 08 Jan, 2018 1 commit
  8. 26 Sep, 2017 1 commit
  9. 11 Sep, 2017 1 commit
    • gulderov's avatar
      Auto-detect running editor on Linux for error overlay (#3077) · 1faee66a
      gulderov authored
      * Auto-detect running editor on Linux for error overlay
      
      Basic support of auto detecting running editor for #2636.
      Tested on Ubuntu 16.04.
      It detects few editors. JetBrains products should start by
      wrapper like /usr/local/bin/webstorm. Otherwise it takes a
      lot of time to open editor.
      
      * Comments fixed.
      
      * List all processes owned by you
      
      * Comment rewording
      1faee66a
  10. 10 Sep, 2017 1 commit
  11. 09 Jul, 2017 1 commit
  12. 07 Jul, 2017 1 commit
  13. 04 Jul, 2017 1 commit
    • Trygve Aaberge's avatar
      Reorder vim arguments in launchEditor so --remote works (#2723) · f495c155
      Trygve Aaberge authored
      This allows you to set REACT_EDITOR to 'vim --remote', so the file can
      be opened in an already running vim process. When using vim without
      remote, it works in the same way as before.
      
      When launching vim without --remote, the order of the line and path
      arguments doesn't matter. However, when using --remote the line argument
      has to precede the path. This happens to be the same as joe and emacs
      uses, so the vim cases were just moved there.
      
      I haven't tested this with mvim, but the documentation says the same as
      the vim documentation, so I assume it works the same.
      f495c155
  14. 28 Jun, 2017 1 commit
  15. 27 Jun, 2017 3 commits
  16. 26 Jun, 2017 1 commit
  17. 30 May, 2017 1 commit
  18. 20 May, 2017 1 commit
  19. 14 May, 2017 2 commits