fix: prevent RCE in openURLMiddleware via URL sanitization - #2758

Merged

thymikee merged 10 commits into

mainfrom

copilot/reamtempt-url-sanitisation

Jan 28, 2026

Commits on Jan 27, 2026

Initial plan
Copilot
committed
1e3f67b
fix: use strict-url-sanitise to prevent RCE vulnerability (CVE-2025-11953)

Copilot
and
huntie
committed
353763c
refactor: cache sanitizeUrl to improve performance

Copilot
and
huntie
committed
5f5105b
simplify: use "Invalid URL" error message, remove strict-url-sanitise mock

Copilot
and
huntie
committed
f8a1ff0
style: replace it() with test() in openURLMiddleware tests

Copilot
and
huntie
committed
08bba3f
refactor: use ordinary import for strict-url-sanitise

Copilot
and
huntie
committed
a340aff
refactor: remove named export of openURLMiddleware, test default export

Copilot
and
huntie
committed
9cdcd7a
test: add CVE-2025-11953 test cases for Windows pipe and command exfiltration

Copilot
and
huntie
committed
32fdc76
test: add CVE-2025-11953 comment above second test case

Copilot
and
huntie
committed
d4f2711

Commits on Jan 28, 2026

fixup tests to not hang when fail
thymikee
committed
41cef8e