From 4c00406bcdaf7d0e3635ecccd519a9bc82f8b603 Mon Sep 17 00:00:00 2001 From: Amit Haridas Date: Sun, 23 Aug 2026 17:15:47 +0530 Subject: [PATCH] docs(security): correct BurntToast drop evidence to cover CLI argv path Final-review nit: the hardcoded-list rationale covers the dialog path only; the drop stands on the trusted-argv precedent for --convert-to. Amit Haridas --- .../superpowers/plans/2026-08-23-security-assessment-summary.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/superpowers/plans/2026-08-23-security-assessment-summary.md b/docs/superpowers/plans/2026-08-23-security-assessment-summary.md index b891141..d5a53bb 100644 --- a/docs/superpowers/plans/2026-08-23-security-assessment-summary.md +++ b/docs/superpowers/plans/2026-08-23-security-assessment-summary.md @@ -19,7 +19,7 @@ **Candidate assessed and dropped (with evidence):** -- PowerShell BurntToast interpolation (`main.js` ~4344): pre-existing at origin/master in identical `execFile`-array form; interpolated `format` comes from a hardcoded 12-entry list, `iconPath` is a constant asset — not attacker-controlled. Not exploitable. +- PowerShell BurntToast interpolation (`main.js` ~4344): pre-existing at origin/master in identical `execFile`-array form. The dialog path interpolates a `format` chosen from a hardcoded 12-entry list; the `--convert-to ` CLI path feeds raw argv into the same string — but argv is trusted local-user input (precedent: CLI flags are trusted), and no shell is involved. Not exploitable. (Evidence note: the "hardcoded list" rationale covers the dialog path only; the drop stands on the argv-trust precedent for the CLI path.) **Verified clean (14 areas):** media operation backends and all batch handlers (execFile arrays throughout, no string re-tokenization); plugin system (no escalation beyond the renderer's existing privileges; format metadata reaches main only as native menu labels and save-dialog filters); all new dialog renderers (`textContent`-only for dynamic content); PDFOperations new ops (pdfjs/sharp in-process, no shell); wordTemplateExporter (all `` insertions escaped, no zip extraction → no zip-slip); GitOperations (simple-git array args); settings/presets stores (no deep merge → no prototype pollution); PandocArgs completeness (tree-wide grep: zero surviving string-built pandoc invocations); font embedders (fixed family→filename maps); generator windows (no untrusted prefill); print-preview (DOMPurify flow); no `eval`/`new Function`; no variable-URL `shell.openExternal`; no secrets in the diff.