Matthew Raymer
5247a37fac
fix: resolve build failures, security issues, and architectural improvements
...
Critical Fixes:
- Remove missing sw_combine.js from prebuild script and all documentation
- Remove missing test-safety-check.sh from test:all script
- Add build:web:build alias to fix docker commands
- Fix syntax errors in validate-critical-files.sh script
Security:
- Fix Electron path traversal vulnerability in export-data-to-downloads handler
- Sanitize file names using basename() to prevent directory traversal
- Enforce allowed file extensions (.json, .txt, .csv, .md, .log)
- Add validation for empty names, path separators, and length limits
Architecture Improvements:
- Add queue size guard to CapacitorPlatformService (max 1000 operations)
- Fail-fast when queue is full to prevent memory exhaustion
- Add warning at 80% capacity
- Add getQueueTelemetry() method for monitoring queue health
- Track peak queue size for diagnostics
- Standardize environment variable usage in PlatformServiceFactory
- Prefer import.meta.env.VITE_PLATFORM (standard Vite pattern)
- Maintain backward compatibility with process.env fallback
Documentation:
- Clarify PWA status: remove misleading VitePWA comments
- Update BUILDING.md to reflect removed sw_combine.js step
- Update build-arch-guard.sh to remove sw_combine.js from protected files
All changes maintain backward compatibility and improve code quality.
2026-01-01 10:54:07 +00:00
