safishamsi and Claude Opus 4.8
e1d9deed6a
security(fortran): strip #include directives before cpp (GHSA-pcc4-rvhr-2pr8)
...
The Fortran capital-F cpp step relied on -nostdinc -I /dev/null to block
#include-based host-file reads, but cpp always searches the source file's
own directory for quoted includes and always honours absolute paths
regardless of those flags. A malicious .F/.F90 file with
#include "/etc/passwd" or #include "../../../secret" could inline
arbitrary host files into graph.json/GRAPH_REPORT.md and the LLM context
on the default offline path (CWE-22/73/200, high severity).
Strip every #include directive before preprocessing and feed the
sanitized source to cpp on stdin, so cpp never opens the file's directory
or any absolute/traversing include path. Macro expansion (#define/#ifdef,
the actual reason capital-F files need cpp) is preserved; cross-file
include fidelity is traded away to close the arbitrary-read vector.
Feeding stdin also removes the -I/etc/x.F90 argument-injection edge case.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-09-27 18:56:31 +01:00
..
2026-09-21 19:19:26 +01:00
2026-09-10 23:04:40 +01:00
2026-09-05 01:18:59 +01:00
2026-09-05 01:18:59 +01:00
2026-09-12 17:36:09 +01:00
2026-09-10 23:04:40 +01:00
2026-09-12 22:23:00 +01:00
2026-09-11 22:46:15 +01:00
2026-09-22 17:30:28 +01:00
2026-09-21 19:44:17 +01:00
2026-09-12 17:36:09 +01:00
2026-09-22 15:00:07 +01:00
2026-09-22 14:58:22 +01:00
2026-09-11 22:51:35 +01:00
2026-09-05 21:55:34 +01:00
2026-09-17 11:01:38 +01:00
2026-08-29 19:32:51 +01:00
2026-09-14 18:55:31 +01:00
2026-09-25 15:44:08 +01:00
2026-09-17 11:03:41 +01:00
2026-09-27 18:56:31 +01:00
2026-09-13 17:47:56 +01:00
2026-09-02 14:58:01 +01:00
2026-09-05 01:18:59 +01:00
2026-09-09 11:30:27 +01:00
2026-09-27 18:39:52 +01:00
2026-09-25 16:01:47 +01:00
2026-09-07 20:21:35 +01:00
2026-09-25 16:01:47 +01:00
2026-09-26 13:53:08 +01:00
2026-09-02 03:05:59 +01:00
2026-09-26 13:53:08 +01:00
2026-08-29 18:38:33 +01:00
2026-09-05 01:18:59 +01:00
2026-09-16 15:37:30 +01:00
2026-09-21 19:19:26 +01:00
2026-09-11 23:58:31 +01:00
2026-09-23 16:54:04 +01:00
2026-09-20 18:07:23 +01:00
2026-09-16 16:20:01 +01:00
2026-08-28 01:20:57 +01:00
2026-09-23 19:45:40 +01:00
2026-09-26 13:53:08 +01:00
2026-08-27 20:20:16 +01:00
2026-09-05 21:55:33 +01:00
2026-09-10 14:03:22 +01:00
2026-09-22 14:58:12 +01:00
2026-09-22 14:58:12 +01:00
2026-09-02 14:49:03 +01:00
2026-08-28 01:20:27 +01:00
2026-09-06 16:17:37 +01:00
2026-08-30 15:11:40 +01:00
2026-08-30 15:11:40 +01:00
2026-09-14 18:49:21 +01:00
2026-09-05 21:55:33 +01:00
2026-09-25 16:15:15 +01:00
2026-09-20 13:59:26 +01:00
2026-09-26 13:53:08 +01:00
2026-09-05 01:18:59 +01:00
2026-08-29 16:14:47 +01:00
2026-08-30 15:11:24 +01:00
2026-08-30 15:11:40 +01:00
2026-09-22 17:30:28 +01:00
2026-09-09 17:20:54 +01:00
2026-09-10 22:44:39 +01:00
2026-09-20 13:59:25 +01:00
2026-08-29 16:14:47 +01:00
2026-09-14 18:49:19 +01:00
2026-09-12 21:31:34 +01:00
2026-09-26 13:53:08 +01:00
2026-09-13 17:47:55 +01:00
2026-09-09 11:30:28 +01:00
2026-09-27 18:39:52 +01:00
2026-09-17 11:09:52 +01:00
2026-09-22 17:30:28 +01:00
2026-09-22 17:30:28 +01:00
2026-09-26 13:48:37 +01:00
2026-09-10 22:44:40 +01:00
2026-09-23 17:01:39 +01:00
2026-09-13 17:47:57 +01:00
2026-09-25 16:01:47 +01:00
2026-09-05 01:19:09 +01:00
2026-09-16 14:50:54 +01:00
2026-09-17 11:01:37 +01:00
2026-09-10 22:44:38 +01:00
2026-08-29 16:14:29 +01:00
2026-09-26 13:45:58 +01:00
2026-09-09 17:20:57 +01:00
2026-09-05 21:13:54 +01:00
2026-09-07 19:02:18 +01:00
2026-09-17 11:01:38 +01:00
2026-08-29 16:15:58 +01:00
2026-09-09 17:20:56 +01:00
2026-09-25 15:44:21 +01:00
2026-09-05 21:55:35 +01:00
2026-09-27 18:40:06 +01:00
2026-09-11 22:46:27 +01:00
2026-09-05 21:55:32 +01:00
2026-09-07 18:42:56 +01:00
2026-09-21 19:10:13 +01:00
2026-09-05 21:13:53 +01:00
2026-09-13 17:47:54 +01:00
2026-09-21 18:04:04 +01:00
2026-09-25 15:44:21 +01:00
2026-09-12 17:36:10 +01:00
2026-09-11 22:46:36 +01:00
2026-09-16 14:43:05 +01:00
2026-09-18 15:16:09 +01:00
2026-09-13 17:47:54 +01:00
2026-09-14 18:52:06 +01:00
2026-08-29 18:38:05 +01:00
2026-09-22 17:30:28 +01:00
2026-09-27 18:39:51 +01:00
2026-09-12 21:49:56 +01:00
2026-09-21 19:13:40 +01:00
2026-09-11 22:46:36 +01:00
2026-09-13 17:47:54 +01:00
2026-09-23 17:01:39 +01:00
2026-08-28 01:18:04 +01:00
2026-09-20 13:59:25 +01:00
2026-09-15 18:01:35 +01:00
2026-09-27 18:39:51 +01:00
2026-09-12 17:39:27 +01:00
2026-09-20 18:53:35 +01:00
2026-08-30 15:48:40 +01:00
2026-08-27 20:57:16 +01:00
2026-08-29 16:16:09 +01:00
2026-09-06 16:17:38 +01:00
2026-08-30 15:12:10 +01:00
2026-09-21 19:06:50 +01:00
2026-09-11 22:46:26 +01:00
2026-09-22 17:30:28 +01:00
2026-08-30 15:11:23 +01:00