Safi ad3f3b2d9e harden XML parsing against billion-laughs DoS in extract_csproj and extract_lpk ...

stdlib ET does not cap entity expansion — a crafted .csproj or .lpk with nested
internal entities can exhaust memory. Pre-screen input bytes for <!DOCTYPE and
<!ENTITY before parsing (legitimate MSBuild/Lazarus files never contain these).
Also adds the missing 2 MiB size cap to extract_lpk (csproj already had one).
No new dependencies required.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-26 20:32:14 +01:00

..

__init__.py

…

__main__.py

fix(cli): apply remap_communities_to_previous in cluster-only path (#1028)

2026-05-26 20:12:02 +01:00

affected.py

feat: add v8 affected and import-resolution support

2026-05-22 13:24:54 +01:00

analyze.py

…

benchmark.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

build.py

improve #1007 fix: use _norm_source_file with resolve() for symlink safety

2026-05-26 14:59:13 +01:00

cache.py

…

callflow_html.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

cluster.py

…

dedup.py

fix: CJK/Unicode labels silently skipped in _norm/_norm_label dedup (follow-up to #811) (#937)

2026-05-22 14:26:27 +01:00

detect.py

add .NET project file support (.sln, .csproj, .fsproj, .vbproj, .razor, .cshtml)

2026-05-26 12:27:28 +01:00

diagnostics.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

export.py

Rate-limit backup_if_protected to one folder per day via content hash

2026-05-25 09:14:20 +01:00

extract.py

harden XML parsing against billion-laughs DoS in extract_csproj and extract_lpk

2026-05-26 20:32:14 +01:00

global_graph.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

google_workspace.py

…

hooks.py

fix Husky 9 hook path, skill.md INPUT_PATH literal, per-worker exception isolation

2026-05-23 23:17:40 +01:00

ingest.py

…

llm.py

…

manifest.py

…

mcp_ingest.py

feat: MCP config extractor (.mcp.json, claude_desktop_config.json, mcp.json)

2026-05-26 20:16:41 +01:00

multigraph_compat.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

prs.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

report.py

…

scip_ingest.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

security.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

semantic_cleanup.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

serve.py

Clarify Chinese query segmentation scope (#1026)

2026-05-26 12:24:04 +01:00

skill-aider.md

…

skill-claw.md

…

skill-codex.md

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

skill-copilot.md

…

skill-devin.md

feat: add Devin CLI support (graphify devin install/uninstall) (#1020)

2026-05-26 09:17:18 +01:00

skill-droid.md

…

skill-kiro.md

…

skill-opencode.md

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

skill-pi.md

…

skill-trae.md

…

skill-vscode.md

…

skill-windows.md

feat: add v8 affected and import-resolution support

2026-05-22 13:24:54 +01:00

skill.md

Fix Ukrainian README typo, Unicode vocab regex, add migration note for Java extends->inherits

2026-05-24 20:40:49 +01:00

symbol_resolution.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

transcribe.py

…

tree_html.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

validate.py

…

watch.py

fix graphify update ghost nodes: as_posix() and relativize existing graph before eviction

2026-05-26 20:05:31 +01:00

wiki.py

Fix wiki TypeError on null source_file and skip nested worktrees/ dirs (#1016, #1023)

2026-05-26 09:06:43 +01:00