This is an automated email from the git hooks/post-receive script.
git pushed a commit to reference refs/pull/34/head
in repository terminology.
View the commit online.
commit 1af4de14e3952c097e8244687f1ca3a0b135a8ab
Author: [email protected] <[email protected]>
AuthorDate: Sun Mar 29 21:25:09 2026 -0600
security: tighten tytab keypress timeout from 7s to 1s
Reduces the window for escape sequence injection attacks. With the
nonce protocol, this is defense-in-depth — the user must have pressed
a key within the last second.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---
src/bin/win.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/bin/win.c b/src/bin/win.c
index 9b7d50ab..6981b1a7 100644
--- a/src/bin/win.c
+++ b/src/bin/win.c
@@ -6737,7 +6737,7 @@ _cb_command(void *data,
/* Anti-bombing check */
now = ecore_time_get();
if (term->last_keypress_time == 0.0 ||
- (now - term->last_keypress_time) > 7.0)
+ (now - term->last_keypress_time) > 1.0)
{
WRN("tab creation blocked: no recent keypress "
"(anti-bombing protection)");
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
