mirror of
https://github.com/aaronsb/obsidian-mcp-plugin.git
synced 2026-07-22 06:45:14 +00:00
638ae4bedb
Closes #175. Records the decision to replace the arbitrary-JS new Function in expression-evaluator.ts with a vetted no-eval expression library — driven by the security reality (.base files are syncable/shareable, so the current path is arbitrary code execution from untrusted files in a live plugin), not the (non-gating) scanner finding. Hard constraints recorded: no hand-rolled parser (its own risk class), and a mandatory differential test corpus (new == old). Implementation tracked in #180; rejected alternatives (accept-and-document, hand-rolled parser, heavy sandbox) documented with rationale. |
||
|---|---|---|
| .. | ||
| adr | ||
| architecture | ||
| scripts | ||
| tools | ||
| bases-implementation-fixes.md | ||
| bases-implementation-status.md | ||
| bases-implementation.md | ||
| bases-mcp-reference.md | ||
| graph-traversal.md | ||
| Plugin_UI_July_2025.png | ||
| PROJECT_STRUCTURE.md | ||
| SECURITY-IMPLEMENTATION.md | ||
| troubleshooting.md | ||
