engine 0.4.47: close two live CodeQL alerts on main — remote property injection + log forgery - #34

Open

mdheller wants to merge 6 commits into

mainfrom

fix/codeql-injection-alerts

Commits on Jul 30, 2026

engine 0.4.47: close two live CodeQL alerts on main — property injection + log forgery
mdheller
committed
log-safe: cover \p{Cf}, and stop deriving the test's bar from the implementation
mdheller
committed
log-safe: escape astral format characters as themselves, not as a surrogate
mdheller
committed
log-safe: the sanitizer must not be able to throw (Copilot review, #34)
mdheller
committed
superpeer-service: log the thrown VALUE, not `.message` off a bad cast
mdheller
committed
patternMatcher: the OUTPUT row was still keyed on a plain object
mdheller
committed