newklei 52314112b9 fix(ct_analyzer): escape XML special chars in _compile_csharp() (#106) ...

* fix(ct_analyzer): escape XML special chars in _compile_csharp()

source_path and output_dir were embedded into the .csproj f-string
without escaping. On Linux, filenames may contain XML-special chars
(", <, >, &), allowing a crafted filename to inject arbitrary MSBuild
XML (CWE-91 -> CWE-78).

Fix: wrap both values with xml.sax.saxutils.escape() before
interpolation. The extra {chr(34): '&quot;'} arg covers double-quotes
inside the attribute value (chr(34) avoids an f-string quote conflict
on Python < 3.12).

* Update script_analyzers.py

---------

Co-authored-by: Scott Arciszewski <147527775+tob-scott-a@users.noreply.github.com>

2026-02-26 09:07:19 -05:00

..

tests

ci: add lint enforcement with ruff, shellcheck, and shfmt (#10)

2026-01-16 15:13:46 -05:00

__init__.py

Initial release of Trail of Bits Skills Marketplace

2026-01-14 15:24:03 -05:00

analyzer.py

ci: add lint enforcement with ruff, shellcheck, and shfmt (#10)

2026-01-16 15:13:46 -05:00

script_analyzers.py

fix(ct_analyzer): escape XML special chars in _compile_csharp() (#106)

2026-02-26 09:07:19 -05:00