dsh-git-review

cwd comes straight from the JSON body and is only realpath'ed, never checked against the session workspace or an allow-list. Every fence (fenceRepoPath/fenceWorkspacePath/fenceWorkspaceDir) is computed relative to that caller-chosen root, so `cwd: "/"` (or any directory outside a repo) makes `file-content`, `file-bytes`, `fs-list`, `list-files`, `file-op` and `open-with` operate anywhere on the filesystem — e.g. read /etc/passwd via file-content, list directories, or delete/rename arbitrary files with `await rm(absPath, { recursive: stat.isDirectory(), force: false })` after a client-set confi

inside() only compares the lexical relative path, and resolve() does not resolve symlinks. A repository containing a symlinked directory (trivially obtained by cloning a hostile repo) lets `path: "link/secret"` pass the fence while lstat/open follow the symlink, so file-content, fs-list, file-op delete/rename and open-with can reach targets outside the repository/workspace.

confirm is a plain JSON boolean supplied by the same request that asks for push, reset --hard, clean -fd, branch -D, stash drop or file deletion, so it is a UI hint, not a security control. The prefix handler performs no origin/token check; safety depends entirely on the host webServer fronting this API, meaning any same-origin script or any client able to POST application/json can run destructive repository operations.

Arguments are passed as an argv array (no shell), but the action will launch the OS default handler (xdg-open) or explorer/code on an absolute path derived from the request; combined with the unconfined cwd this can open arbitrary files, and on Windows `"/select," + absPath` is a single unquoted argument.

isPathologicalRegex only catches nested-quantifier forms inside parentheses; patterns such as `a*a*a*a*b` (up to 200 chars) are compiled and executed against section bodies capped at DIFF_CAP (2 MB) in the request path, which can block the event loop for the whole host.