bdo-cli 0.45.3 → 0.45.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +30 -0
- package/README.md +1 -1
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,36 @@ All notable changes to Bushido (bdo) will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [0.45.4] (2026-09-19)
|
|
9
|
+
|
|
10
|
+
### Security
|
|
11
|
+
|
|
12
|
+
- **`bdo err` / `bdo test` command injection.** Both joined their argument
|
|
13
|
+
vector with spaces and handed the string to `sh -c`. An argument containing
|
|
14
|
+
a space was split into several, and shell metacharacters inside an argument
|
|
15
|
+
became executable — `bdo err grep 'x; touch F' file` ran `touch`. Both now
|
|
16
|
+
exec via argv, the shell path is removed, and an empty wrapped command is an
|
|
17
|
+
error instead of `sh -c ""` exiting 0.
|
|
18
|
+
|
|
19
|
+
**Behavior change**: packing shell syntax into a single argument
|
|
20
|
+
(`bdo test "cargo test && echo ok"`) no longer works — that form and the
|
|
21
|
+
injection were the same code path. Ask for a shell explicitly and it is
|
|
22
|
+
delivered intact: `bdo test sh -c 'cargo test && echo ok'`. Every documented
|
|
23
|
+
usage (`bdo err cargo build`, `bdo test cargo test`) is unaffected.
|
|
24
|
+
|
|
25
|
+
### Fixes
|
|
26
|
+
|
|
27
|
+
- **`bdo find <dir>`** — the most common native form, and what the hook
|
|
28
|
+
produces — was read as a glob pattern searched under `.`, a different command
|
|
29
|
+
that usually found nothing. A lone argument with a path separator and no glob
|
|
30
|
+
characters is now the start path. A missing start path exits 1 with find's
|
|
31
|
+
message instead of reporting zero matches and exiting 0, so `bdo find … &&`
|
|
32
|
+
chains stop where native find would.
|
|
33
|
+
|
|
34
|
+
Together these close the ledger's "compound command / exit code
|
|
35
|
+
interference" item: the interference was bdo running a different command
|
|
36
|
+
than the one asked for, not a harness artifact.
|
|
37
|
+
|
|
8
38
|
## [0.45.3] (2026-09-19)
|
|
9
39
|
|
|
10
40
|
### Security
|
package/README.md
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"artifactDownloadUrls": [
|
|
3
|
-
"https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.45.
|
|
3
|
+
"https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.45.4"
|
|
4
4
|
],
|
|
5
5
|
"author": "Patrick Szymkowiak",
|
|
6
6
|
"bin": {
|
|
@@ -91,7 +91,7 @@
|
|
|
91
91
|
"zipExt": ".tar.xz"
|
|
92
92
|
}
|
|
93
93
|
},
|
|
94
|
-
"version": "0.45.
|
|
94
|
+
"version": "0.45.4",
|
|
95
95
|
"volta": {
|
|
96
96
|
"node": "18.14.1",
|
|
97
97
|
"npm": "9.5.0"
|