Skip to content

fix(security): declare the printed install-script URL on the allow-list #1333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DeusData merged 1 commit into from
Jul 29, 2026
Merged

fix(security): declare the printed install-script URL on the allow-list #1333

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions scripts/security-allowlist.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,7 @@ src/ui/http_server.c:execl:exec indexing binary in child process
URL:https://api.github.com/repos/DeusData/codebase-memory-mcp/releases/latest:update check
URL:https://github.com/DeusData/codebase-memory-mcp/releases/latest/download:binary download + checksums
URL:https://github.com/DeusData/codebase-memory-mcp/releases/latest:version check via redirect header
URL:https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh:printed by `update` as the install-script command when install.sh is not beside the binary (a string in the message, not a network call - the binary no longer downloads anything)
URL:http://127.0.0.1:UI server binding (localhost only)
URL:https://www.sqlite.org/c3ref/c_checkpoint_full.html:sqlite WAL checkpoint API doc reference (comment only, not a network call)
URL:https://github.com/DeusData/codebase-memory-mcp:project repository self-reference in update/star notice (src/mcp/mcp.c)
Expand Down
9 changes: 7 additions & 2 deletions src/cli/cli.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11168,6 +11168,12 @@ static bool check_already_latest(void) {

#endif /* CBM_CLI_ENABLE_TEST_API */

/* One token on purpose: the security audit extracts URLs literally, so a URL
* split across string-literal continuations cannot be matched against the
* allow-list. Printed for the user to paste; never fetched by this binary. */
#define CBM_INSTALL_SH_URL \
"https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh"

int cbm_cmd_update(int argc, char **argv) {
parse_auto_answer(argc, argv);

Expand Down Expand Up @@ -11257,8 +11263,7 @@ int cbm_cmd_update(int argc, char **argv) {
if (have_dir) {
printf(" bash \"%s/install.sh\"\n\n", self_dir);
} else {
printf(" curl -fsSL https://raw.githubusercontent.com/DeusData/"
"codebase-memory-mcp/main/install.sh | bash\n\n");
printf(" curl -fsSL " CBM_INSTALL_SH_URL " | bash\n\n");
}
printf("It downloads the latest release, verifies its checksum, and replaces\n"
"this binary in place. install.sh is idempotent, so re-running it IS\n"
Expand Down
Loading