coder-master-0915 745f780c34 fix(terminal-core): prevent String.replace $ pattern injection in display-string (#111398) ...

* fix(terminal-core): prevent $ pattern injection in replaceHomePath

The second argument of String.prototype.replace() interprets $ sequences
as special replacement patterns ($&, $`, $', $1-$9, $<name>). When the
user home directory path contains $ followed by special characters, the
replacement produces a corrupted path in the display string.

Using a replacer function (() => fallbackHome) instead of the raw string
argument prevents $ pattern interpretation, ensuring the literal home
directory path is used regardless of its content.

* test(terminal-core): cover literal dollar home paths

---------

Co-authored-by: lizeyu-xydt <li.zeyu@xydigit.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>

2026-07-29 06:24:49 -04:00

..

src

fix(terminal-core): prevent String.replace $ pattern injection in display-string (#111398)

2026-07-29 06:24:49 -04:00

package.json

chore: update dependencies across workspace (#115677)

2026-07-29 05:16:42 -04:00