* security: validate CLI paths/args in dev tools (SonarCloud S2083/S8707/S8705/S7044)
Resolve and validate command-line path arguments before use, enforce HTTPS at
download sinks, and confirm path containment. Hardens local codegen/fetch tools
against path-traversal and command-argument-injection findings.
* ci: exclude dev tool scripts from SonarCloud coverage gate
The extract_tables.py codegen tools aren't part of the unit-tested surface;
exclude tools/, docs/, examples/ from coverage so the new-code coverage gate
doesn't block hardening-only changes.
The async screenshot() handler read and deleted the screenshot with blocking
std::fs calls, stalling the Tokio executor. Switch to tokio::fs::read /
tokio::fs::remove_file (await) and enable the tokio "fs" feature.
Calls storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
with secrets: inherit. Adds SonarCloud badge to README where missing and
removes the redundant sonar-project.properties (config now passed by the
reusable workflow).
Adds .coderabbit.yaml so CodeRabbit no longer reviews or comments on PRs opened by dependabot[bot].
Co-authored-by: Claude Opus 5.5 <[email protected]>
- decoder.rs: MaxHSize 16384, MaxVSize 8704 and MaxPicSize 35651584 per AV1 Annex A (the earlier
16384 x 8704 product is four times the area limit); boundary unit tests on frame_size_allowed;
README states the three limits.
- testkit: with_deadline/set_progress (whole-sweep hang guard naming the last input;
FILMCRAFT_HOSTILE_TIMEOUT_SECS overrides) and ffmpeg_has_encoder.
- The nine fuzz_hostile tests drop their per-run elapsed assertions (which could not catch a
hang and could fail a slow runner) and run under the guard.
- A seed whose encoder is absent from ffmpeg still skips (and fails under
FILMCRAFT_REQUIRE_ORACLES=1); an encoder that is present but fails now fails the test.
- mpeg2v failure labels carry the seed name.
The exact 16384 x 8704 boundary stays covered by the frame_size_allowed unit tests;
decoding such a frame needs ~1.5 GB, too much for every cargo test. Empty seeds and the
mpeg2v seed skip now say so, like the other skips.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The cap was 1 << 27, below the 16384 x 8704 it quotes, so a conforming maximum-size
frame was refused. Extract frame_size_allowed() and test the exact boundary, plus a
stream at 16384 x 8704 that must pass the size check. Note the AV1 and MPEG-2 limits
in the crate READMEs. A fuzz seed that ffmpeg cannot encode (encoder missing) now
reports SKIPPED, and fails under FILMCRAFT_REQUIRE_ORACLES=1, instead of passing silently.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
CodeRabbit on #2006: --control-input-only drops every command-inbox
command, and Quit now arrives that way instead of as terminate:, so it
left the window open. app.quit is let through; other menu commands are
still ignored, as docs/control-protocol.md says.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The native app menu's Quit item was muda's predefined quit, which calls
AppKit's terminate: and owns the Cmd-Q key equivalent, so the window never
got the close request the unsaved-changes prompt waits for. Quit is now a
regular menu item that sends the app.quit command, which closes the window
through the prompt, on the command's shortcut (Cmd-Q unless remapped).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
BFlat