[PR #53] [MERGED] Security hardening and beta group fixes #251

New issue

Closed

opened 2026-02-26 21:34:18 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 21:34:18 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/rudrankriyam/App-Store-Connect-CLI/pull/53
Author: @rudrankriyam
Created: 1/23/2026
Status: ✅ Merged
Merged: 1/23/2026
Merged by: @rudrankriyam

Base: main ← Head: security-hardening

📝 Commits (1)

d289b82 Harden analytics downloads and sandbox inputs

📊 Changes

10 files changed (+684 additions, -40 deletions)

View changed files

📝 cmd/beta.go (+209 -0)
📝 cmd/commands_test.go (+30 -0)
📝 cmd/localizations.go (+19 -1)
📝 cmd/localizations_test.go (+20 -0)
📝 cmd/sandbox.go (+69 -19)
📝 cmd/sandbox_test.go (+33 -0)
📝 internal/asc/analytics_test.go (+32 -0)
📝 internal/asc/client.go (+147 -20)
📝 internal/asc/client_http_test.go (+78 -0)
📝 internal/asc/output_test.go (+47 -0)

📄 Description

Summary\n- sanitize terminal output for feedback/review/crash table + markdown rendering\n- allow analytics downloads from CDN hosts only when URLs are signed\n- reject symlink/non-regular .strings inputs during localization uploads\n- add stdin-based secrets for sandbox tester creation\n- validate --public-link-limit via flag presence in beta group updates\n\n## Testing\n- make test\n- go test -race ./... (ld warnings about malformed LC_DYSYMTAB on macOS)\n- make lint

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/rudrankriyam/App-Store-Connect-CLI/pull/53 **Author:** [@rudrankriyam](https://github.com/rudrankriyam) **Created:** 1/23/2026 **Status:** ✅ Merged **Merged:** 1/23/2026 **Merged by:** [@rudrankriyam](https://github.com/rudrankriyam) **Base:** `main` ← **Head:** `security-hardening` --- ### 📝 Commits (1) - [`d289b82`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/d289b825f4a4e7538967076347fa0d99e62db564) Harden analytics downloads and sandbox inputs ### 📊 Changes **10 files changed** (+684 additions, -40 deletions) <details> <summary>View changed files</summary> 📝 `cmd/beta.go` (+209 -0) 📝 `cmd/commands_test.go` (+30 -0) 📝 `cmd/localizations.go` (+19 -1) 📝 `cmd/localizations_test.go` (+20 -0) 📝 `cmd/sandbox.go` (+69 -19) 📝 `cmd/sandbox_test.go` (+33 -0) 📝 `internal/asc/analytics_test.go` (+32 -0) 📝 `internal/asc/client.go` (+147 -20) 📝 `internal/asc/client_http_test.go` (+78 -0) 📝 `internal/asc/output_test.go` (+47 -0) </details> ### 📄 Description ## Summary\n- sanitize terminal output for feedback/review/crash table + markdown rendering\n- allow analytics downloads from CDN hosts only when URLs are signed\n- reject symlink/non-regular .strings inputs during localization uploads\n- add stdin-based secrets for sandbox tester creation\n- validate --public-link-limit via flag presence in beta group updates\n\n## Testing\n- make test\n- go test -race ./... (ld warnings about malformed LC_DYSYMTAB on macOS)\n- make lint --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>