mirror of
https://github.com/aaronsb/obsidian-mcp-plugin.git
synced 2026-07-22 06:45:14 +00:00
73b3276453
Advisor review follow-up on #186: - Add SECURITY cases note[("cons"+"tructor")] / file[("__pro"+"to__")]: runtime-computed member names our static pre-walk intentionally does NOT catch (property is BinaryExpression, not Identifier/Literal) — they must fail closed via expression-eval's own access guard. Test-grounds the defense-in-depth claim instead of asserting it. 60/60 green. - CLAUDE.md 'Known accepted review findings': the Bases new Function is REMOVED (ADR-201, #180/#185/#186), not pending #175. Documents the honest caveat — grep 'new Function' main.js != 0 by design: residual is transitive ajv@6.14.0 validator codegen + a deprecation shim, a pre-existing library-internal class not reachable from vault content, present on the reviewed 0.11.25, non-gating. Scanner finding was attributed to the Bases path; this closes that path. Refs #180, ADR-201 |
||
|---|---|---|
| .. | ||
| __mocks__ | ||
| fixtures | ||
| security | ||
| validation | ||
| bases-expression-evaluator.test.ts | ||
| bases-yaml.test.ts | ||
| dataview-integration.test.ts | ||
| graph-search-traversal.test.ts | ||
| list-files-recursive.test.ts | ||
| mcp-server.test.ts | ||
| patch-operations.test.ts | ||
| read-only-mode.test.ts | ||
| recursive-copy.test.ts | ||
| search-tag-operator.test.ts | ||
| setup.ts | ||