CloakBrowser

mirror of https://github.com/CloakHQ/CloakBrowser.git synced 2026-06-23 11:41:46 +02:00

Files

T

CloakHQ 402a884088 fix(download): pass extract paths to PowerShell via env vars

Windows zip extraction interpolated archive/dest paths directly into the
PowerShell -Command string. A single quote in the path (e.g. a Windows
account like C:\Users\O'Brien) closed the string literal early, breaking
extraction and creating a code-injection shape. execFileSync guards the
OS-shell boundary but not the PowerShell interpreter inside.

Pass both paths via env vars ($env:CB_ARCHIVE / $env:CB_DEST) so
PowerShell reads them as data, never as code. No escaping needed.

Python wrapper unaffected (zipfile module + argv).

2026-06-20 02:19:48 +02:00

human

fix(humanize): correct iframe coordinate offset in pointer-events check (#303 )

2026-05-25 01:15:09 +02:00

human-puppeteer

refactor(js): extract HumanActionOptions type, fix frame check/uncheck error handling, align SOCKS5 log level

2026-05-11 00:23:31 +02:00

args.ts

feat: add extension_paths parameter for loading Chrome extensions (#210 )

2026-05-15 21:08:42 +02:00

cli.ts

feat: add CLI for binary management (Python + JavaScript)