mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 10:35:51 +00:00
rcourtman
2c51890d01
install.sh: - find_pulse_binary_in_dir now rejects symlinks, so a malicious tarball that smuggled a symlink at the expected binary path cannot redirect the cp to $INSTALL_DIR/bin/pulse onto an arbitrary file outside the extract dir. - tar -xzf calls in install_pulse_archive now pass --no-same-owner --no-overwrite-dir, defending against archive entries that try to chown extracted files or rewrite existing directory metadata. Demo deploy workflows: - deploy-demo-server.yml routes inputs.target through env: so the workflow_dispatch input cannot break out of the case statement, even though type: choice constrains it client-side. - update-demo-server.yml routes inputs.tag, inputs.target, and github.event.release.tag_name through env: for the same reason. All defense-in-depth: download_release_archive still signature- verifies the tarball, and the demo workflows are gated to write- access dispatchers. The argument-vs-env distinction matters once the trigger surface or trust boundary changes.