Hibryda 0324f813e2 fix(security): resolve critical audit findings in marketplace and frontend ... CRITICAL fixes: - marketplace.rs: Replace fake SHA-256 (SipHash) with real sha2 crate - marketplace.rs: Reject empty checksums (refuse unsigned plugins) - marketplace.rs: Add install path traversal protection (reject ../|/|\) - marketplace.rs: Add HTTPS-only URL validation on download_url - marketplace.rs: Add curl --proto =https to block file:/gopher: SSRF - marketplace.rs: Add --max-filesize 50MB download cap - marketplace.rs: Add --no-same-owner --no-same-permissions to tar extraction - marketplace.rs: Post-extraction path validation (canonicalize check) Frontend fixes: - pro-bridge.ts: Rename Symbol→CodeSymbol (avoid global collision) - pro-bridge.ts: Tighten trust type to union 'human'|'agent'|'auto' - PluginMarketplace.svelte: URL sanitization (reject non-https hrefs) Remaining audit fixes (HIGH/MEDIUM/LOW) being applied by background agents — will be committed separately when complete.		2026-03-17 03:50:10 +01:00
..
src	fix(security): resolve critical audit findings in marketplace and frontend	2026-03-17 03:50:10 +01:00
Cargo.toml	fix(security): resolve critical audit findings in marketplace and frontend	2026-03-17 03:50:10 +01:00