safishamsiandClaude Opus 4.8 e1d9deed6a security(fortran): strip #include directives before cpp (GHSA-pcc4-rvhr-2pr8) ...

The Fortran capital-F cpp step relied on -nostdinc -I /dev/null to block
#include-based host-file reads, but cpp always searches the source file's
own directory for quoted includes and always honours absolute paths
regardless of those flags. A malicious .F/.F90 file with
#include "/etc/passwd" or #include "../../../secret" could inline
arbitrary host files into graph.json/GRAPH_REPORT.md and the LLM context
on the default offline path (CWE-22/73/200, high severity).

Strip every #include directive before preprocessing and feed the
sanitized source to cpp on stdin, so cpp never opens the file's directory
or any absolute/traversing include path. Macro expansion (#define/#ifdef,
the actual reason capital-F files need cpp) is preserved; cross-file
include fidelity is traded away to close the arbitrary-read vector.
Feeding stdin also removes the -I/etc/x.F90 argument-injection edge case.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-09-27 18:56:31 +01:00

..

__init__.py

feat: add Erlang language extractor

2026-09-21 19:19:26 +01:00

apex.py

…

base.py

fix(go): scope the predeclared-function filter to Go bare identifiers

2026-07-30 17:13:48 +01:00

bash.py

fix(bash): resolve exec-position script paths built from a variable

2026-09-09 17:20:57 +01:00

blade.py

…

cobol.py

fix(cobol): link both endpoints of a PERFORM ... THRU range

2026-09-25 15:44:08 +01:00

commonlisp.py

fix(commonlisp): derive node ids from the full path stem

2026-08-27 20:20:36 +01:00

csharp.py

fix: prevent C# member nodes from being resolved as types

2026-09-25 16:01:47 +01:00

dart.py

Add source_location to Dart extraction

2026-09-07 20:21:35 +01:00

dm.py

Fix DreamMaker parent-relative #include paths (lstrip charset misuse)

2026-07-18 12:03:47 +01:00

elixir.py

fix(elixir): extract defprotocol and defimpl as containers

2026-09-26 13:39:37 +01:00

engine.py

fix(extract): skip JSX member tags

2026-09-27 18:39:52 +01:00

erlang.py

feat: add Erlang language extractor

2026-09-21 19:19:26 +01:00

fortran.py

security(fortran): strip #include directives before cpp (GHSA-pcc4-rvhr-2pr8)

2026-09-27 18:56:31 +01:00

go.py

Preserve case-only interface signature owners

2026-09-22 14:58:12 +01:00

json_config.py

fix(json_config): stop emitting self-referential dep imports and array-as-extends edges

2026-09-05 21:55:34 +01:00

julia.py

fix(julia): extract macro definitions and @enum types

2026-09-26 13:48:37 +01:00

markdown.py

fix(markdown): honour dotted qualifiers and explicit relative cites in mention resolution

2026-09-16 14:50:54 +01:00

MIGRATION.md

…

models.py

fix(ts): type-only imports no longer manufacture Import Cycles (#3123)

2026-08-29 16:16:09 +01:00

objc.py

fix(objc): protocol not a receiver type, category fold, property/ivar receivers (#2589, #2590, #2591)

2026-08-10 18:06:50 +01:00

ocaml.py

fix(ocaml): extract classes and their methods and instance variables

2026-09-26 13:45:58 +01:00

pascal_forms.py

…

pascal.py

…

powershell.py

fix(powershell): extract enum definitions and their members

2026-08-24 13:16:45 +01:00

r.py

feat: add R language extractor

2026-09-21 19:10:13 +01:00

razor.py

fix(razor): resolve @inject types across files (#3187)

2026-08-29 18:38:33 +01:00

resolution.py

fix(python): resolve nested scan-root imports via namespace projection (#3843)

2026-09-27 18:40:06 +01:00

robot.py

fix(robot): namespace the external-library stub id to avoid keyword collision (#3192)

2026-08-30 15:16:49 +01:00

rust.py

fix: resolve generic Rust self calls

2026-09-18 15:16:09 +01:00

sln.py

…

solidity.py

fix: complete the Solidity/method-ghost/Erlang review items (#3716, #3719, #3714 follow-ups)

2026-09-21 19:44:17 +01:00

sql.py

fix(sql): emit index nodes for CREATE [UNIQUE] INDEX statements

2026-09-10 14:51:54 +01:00

terraform.py

fix(terraform): redact the value paired with a secret-named name in name/value lists

2026-09-27 18:39:51 +01:00

vbnet.py

feat: add VB.NET language extractor

2026-09-21 19:06:50 +01:00

verilog.py

fix(verilog): link a module instantiation to the local definition, not a phantom

2026-09-20 13:59:25 +01:00

zig.py

fix(zig): extract methods declared on enums and unions

2026-08-24 13:15:23 +01:00