DanSandClaude Fable 5 13788b5dd0 fix(security): harden untrusted-input parsing (Tier 4 audit items) ...

- export: neutralize CSV/spreadsheet formula injection in transaction export —
  escapeCSV() now prefixes fields beginning with = + - @ / tab / CR with a
  single quote so a hostile memo/address cannot execute on open (F13-1).
- console: preserve explicitly-quoted empty arguments in ParseConsoleCommandArgs
  so a "" no longer collapses and shifts later positional RPC params; adds a
  regression assertion to testConsoleInputModel (F14-1).
- send: copy pending payment-URI address/memo with snprintf("%s") instead of
  strncpy(…, sizeof-1), which does not NUL-terminate on truncation (F8-2).

All build clean (full-node + tests) and the suite passes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-22 01:56:13 -05:00

..

fixtures

feat(updater): in-app dragonxd updater + browse-all-releases

2026-06-27 21:27:13 -05:00

fake_lite_backend.h

feat(lite): async wallet creation with server failover

2026-06-08 11:29:59 -05:00

test_phase4.cpp

fix(security): harden untrusted-input parsing (Tier 4 audit items)

2026-07-22 01:56:13 -05:00