Problem
macOS PlayerPrefs listing passes project-derived company/product strings through a single Arguments string for the defaults process.
Evidence
Editor/MCPServerMethods.PlayerPrefs.cs:72-78 builds plist domain names from PlayerSettings.companyName, PlayerSettings.productName, and application identifier.Editor/MCPServerMethods.PlayerPrefs.cs:82 constructs new ProcessStartInfo("defaults", $"read \"{domain}\"").UseShellExecute = false avoids shell execution, but embedded quotes in project metadata can still confuse command argument parsing.
Impact
Unusual or malicious project metadata can cause the defaults invocation to read the wrong domain or fail in confusing ways.
Suggested fix
Use ProcessStartInfo.ArgumentList for defaults read <domain>, or reject/escape quotes in generated domains before building arguments.
Source report
Imported from audit report item: security (15) / Editor/MCPServerMethods.PlayerPrefs.cs:82.
Problem
macOS PlayerPrefs listing passes project-derived company/product strings through a single
Argumentsstring for thedefaultsprocess.Evidence
Editor/MCPServerMethods.PlayerPrefs.cs:72-78builds plist domain names fromPlayerSettings.companyName,PlayerSettings.productName, and application identifier.Editor/MCPServerMethods.PlayerPrefs.cs:82constructsnew ProcessStartInfo("defaults", $"read \"{domain}\"").UseShellExecute = falseavoids shell execution, but embedded quotes in project metadata can still confuse command argument parsing.Impact
Unusual or malicious project metadata can cause the
defaultsinvocation to read the wrong domain or fail in confusing ways.Suggested fix
Use
ProcessStartInfo.ArgumentListfordefaults read <domain>, or reject/escape quotes in generated domains before building arguments.Source report
Imported from audit report item:
security (15)/Editor/MCPServerMethods.PlayerPrefs.cs:82.