frostebite 1f3affe097 fix(secrets): prevent shell injection in secret key names and mask values ...

- Validate secret key names against alphanumeric allowlist before shell interpolation
- Apply validation in both SecretSourceService.fetchSecret() and legacy queryOverride()
- Mask fetched secret values with core.setSecret() to prevent log exposure
- Add 20 new tests for validation and masking

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-05 12:55:18 +00:00

14 MiB

Generated

Raw Blame History

The file is too large to be shown. View Raw