Advisory updates

[godronus]

No description provided.

[Copilot]

Pull request overview

This PR hardens the FastEdge VS Code extension against CWE-78 (OS command injection) by removing shell-based process spawning from build tool invocations and Docker command generation, then adds cross-platform tests + fixtures to prove the safer spawn patterns actually work on Windows/macOS/Linux.

Changes:

• Removed shell usage from JS/AssemblyScript/Rust compiler launches; replaced npx + shell: true with process.execPath + resolved package bin scripts.
• Updated MCP mcp.json generation to invoke docker directly with an argv array and env-forwarding by name (no shell expansion).
• Added unit + integration tests (and fixtures) plus a cross-platform GitHub Actions workflow to validate behavior across OSes.

Reviewed changes

Copilot reviewed 31 out of 36 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tsconfig.json	Typechecks integration tests; excludes fixtures from TS compilation.
package.json	Adds test:integration and fixtures:install scripts.
src/utils/resolveBin.ts	New helper to resolve a project-local package bin entry for safe process.execPath spawning.
src/compiler/jsBuild.ts	Drops npx/shell; validates main containment; runs fastedge-build via resolved bin + process.execPath.
src/compiler/asBuild.ts	Drops npx/shell; runs asc via resolved bin + process.execPath; verifies output exists.
src/compiler/rustBuild.ts	Removes platform shell selection for cargo; adds explicit spawn error handling.
src/compiler/compilerSpawn.test.ts	New regression tests asserting spawn argv safety (no shell parsing) across compilers.
src/compiler/rustConfig.test.ts	New unit tests for Rust WASI target inference / config precedence.
test/integration/compilers.test.ts	New integration tests that run real toolchains against fixtures on each OS.
src/commands/mcpJson.ts	Replaces platform-specific shell commands with a platform-independent docker argv array.
src/commands/mcpJson.test.ts	New tests verifying docker argv shape and lack of shell expansion/wrappers.
src/autorun/triggerFileHandler.ts	Tightens trigger-file command allowlist and removes unused activation-time trigger execution logic.
.github/workflows/test.yml	Adds cross-platform unit + integration test matrix in CI.
.gitignore	Ignores in-place fixture build artifacts (node_modules/build/target/etc.).
context/features/CROSS_PLATFORM.md	Updates documented process-spawning policy to “never use a shell” and describes new patterns.
context/features/COMPILER_SYSTEM.md	Updates compiler docs to describe resolved-bin + process.execPath spawning.
context/features/COMMANDS.md	Updates command docs to match the new no-npx, no-shell JS flow.
context/architecture/EXTENSION_LIFECYCLE.md	Clarifies trigger-file watcher purpose and security constraints.
context/CHANGELOG.md	Adds a detailed security advisory entry documenting the vulnerability and remediation.
test/fixtures/js-app/package.json	JS fixture project for real fastedge-build invocation.
test/fixtures/js-app/index.js	JS fixture entrypoint used by integration build tests.
test/fixtures/as-app/package.json	AssemblyScript fixture dependencies for real asc invocation.
test/fixtures/as-app/tsconfig.json	AssemblyScript fixture tsconfig for toolchain expectations.
test/fixtures/as-app/asconfig.json	AssemblyScript build config mirroring real proxy-wasm examples.
test/fixtures/as-app/assembly/index.ts	AssemblyScript fixture source used by integration build tests.
test/fixtures/rust-app/Cargo.toml	Rust HTTP (wasip1) fixture manifest.
test/fixtures/rust-app/Cargo.lock	Rust HTTP (wasip1) fixture lockfile for reproducible builds.
test/fixtures/rust-app/.cargo/config.toml	Rust HTTP fixture explicit wasm target config.
test/fixtures/rust-app/src/lib.rs	Rust HTTP fixture source.
test/fixtures/rust-app-cdn/Cargo.toml	Rust CDN proxy-wasm fixture manifest (artifact selection coverage).
test/fixtures/rust-app-cdn/Cargo.lock	Rust CDN proxy-wasm fixture lockfile.
test/fixtures/rust-app-cdn/.cargo/config.toml	Rust CDN fixture wasm target config.
test/fixtures/rust-app-cdn/src/lib.rs	Rust CDN fixture source.
test/fixtures/rust-app-wasi-http/Cargo.toml	Rust WASI HTTP (wasip2 inference) fixture manifest (no .cargo/config).
test/fixtures/rust-app-wasi-http/Cargo.lock	Rust WASI HTTP fixture lockfile.
test/fixtures/rust-app-wasi-http/src/lib.rs	Rust WASI HTTP fixture source.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.