0324f813e2
CRITICAL fixes: - marketplace.rs: Replace fake SHA-256 (SipHash) with real sha2 crate - marketplace.rs: Reject empty checksums (refuse unsigned plugins) - marketplace.rs: Add install path traversal protection (reject ../|/|\) - marketplace.rs: Add HTTPS-only URL validation on download_url - marketplace.rs: Add curl --proto =https to block file:/gopher: SSRF - marketplace.rs: Add --max-filesize 50MB download cap - marketplace.rs: Add --no-same-owner --no-same-permissions to tar extraction - marketplace.rs: Post-extraction path validation (canonicalize check) Frontend fixes: - pro-bridge.ts: Rename Symbol→CodeSymbol (avoid global collision) - pro-bridge.ts: Tighten trust type to union 'human'|'agent'|'auto' - PluginMarketplace.svelte: URL sanitization (reject non-https hrefs) Remaining audit fixes (HIGH/MEDIUM/LOW) being applied by background agents — will be committed separately when complete.
17 lines
473 B
TOML
17 lines
473 B
TOML
[package]
|
|
name = "agor-pro"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
description = "Commercial plugin for Agents Orchestrator"
|
|
license = "LicenseRef-Commercial"
|
|
|
|
[dependencies]
|
|
agor-core = { path = "../agor-core" }
|
|
tauri = { version = "2.10.3", features = [] }
|
|
rusqlite = { version = "0.31", features = ["bundled-full"] }
|
|
serde = { version = "1.0", features = ["derive"] }
|
|
serde_json = "1.0"
|
|
log = "0.4"
|
|
dirs = "5"
|
|
tokio = { version = "1", features = ["process"] }
|
|
sha2 = "0.10"
|