Skip to content

fix: resolve security issues, deadlocks, and clean up dead code#21

Merged
moisesvalero merged 1 commit into
mainfrom
fix/audit-security-bugs-cleanup
Jul 13, 2026
Merged

fix: resolve security issues, deadlocks, and clean up dead code#21
moisesvalero merged 1 commit into
mainfrom
fix/audit-security-bugs-cleanup

Conversation

@moisesvalero

Copy link
Copy Markdown
Owner

This Pull Request addresses the security, quality, and bug findings from the comprehensive repository audit.

Changes Implemented:

  1. Security Fixes:

    • Switched to Base64 -EncodedCommand\ in \PowerShellEngine.cs\ and \CommandRepair.cs\ to prevent command injection risks.
    • Moved the Gemini API key from the request URL query parameters to request headers (\x-goog-api-key) in \GeminiProvider.cs.
    • Whitelisted allowed targets in \MainViewModel.AbrirAccion\ to block arbitrary file/process execution.
    • Added regex parameter validation for \IniciarServicio\ in \MainViewModel.cs.
    • Added \settings.json\ (where the WPF app stores API keys in plaintext) to .gitignore.
  2. Bug & Robustness Fixes:

    • Fixed potential deadlocks in \CommandRepair.RunRedirectedAsync\ and \PowerShellEngine.RunPowerShellAsync\ by reading StandardOutput and StandardError streams concurrently.
    • Wrapped JSON deserialization in \PowerShellEngine.CollectAllAsync\ in a try-catch block for \JsonException.
    • Added try-catch exception handling in \MainViewModel.ScanAsync\ to prevent the WPF app from crashing on diagnostic collection errors.
    • Simplified redundant exception checking for \OperationCanceledException\ / \TaskCanceledException\ in \LlmService.cs.
  3. Performance & Cleanups:

    • Removed dead code files \IColector.cs\ and \DiagnosticContext.cs.
    • Removed unused commands (\DownloadModelCommand, \CancelRepairCommand, \ToggleExpandirCommand) and properties (\ScoreColor) from \MainViewModel.cs.
    • Refactored \ChatMessages, \Modulos, and \Problemas\ lists in \MainViewModel.cs\ to use \ObservableCollection\ instead of triggering full list re-renders.
    • Cached compiled \Regex\ instances in \PrivacyFilter.cs.
    • Made \PrivacyFilter's serial anonymization case-insensitive to catch mixed-case serial numbers.
    • Fixed spelling typo in \RulesProvider.cs\ (\Paperas\ -> \Papelera).
    • Mapped \SO.Instalado\ and \SO.UltimoArranque\ properties in \PowerShellEngine.MapToDiagnostico.
    • Replaced duplicate byte-to-GB magic numbers in \HardwareInfo.cs\ with a named constant \BytesPerGB.

- Resolved command injection risks in PowerShellEngine and MainViewModel.
- Fixed API key leak in GeminiProvider by using request headers.
- Fixed potential deadlocks in stream reading in CommandRepair and PowerShellEngine.
- Removed dead code (IColector, DiagnosticContext, unused commands/properties).
- Added settings.json to .gitignore to prevent local key leakage.
- Converted ChatMessages, Modulos, and Problemas collections to ObservableCollection.
@moisesvalero
moisesvalero merged commit bdaac7f into main Jul 13, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant