[Auto Sync] Sync the code from branch main to branch develop after release 1.2.13

[github-actions]

Sync the code from branch main to branch develop after release 1.2.13

To fix the problem, we should avoid constructing the shell command as a single string and instead pass the command and its arguments separately to spawnSync. This approach prevents the shell from interpreting special characters in the arguments, thus mitigating the risk of shell injection.

We will:

1. Replace the dynamic shell command construction with separate command and arguments.
2. Use spawnSync without the -c option to avoid shell interpretation.

To fix the problem, we should avoid passing the entire command string to the shell. Instead, we can use child_process.spawnSync with the command and arguments provided separately. This way, the shell will not interpret any special characters in the paths.

• Replace the dynamic command string with an array of arguments.
• Use child_process.spawnSync without the sh -c option to avoid shell interpretation.

To fix the problem, we should avoid constructing the shell command dynamically with user-controlled input. Instead, we can pass the arguments to the command separately to ensure they are not interpreted by the shell. This can be achieved by using spawnSync without the -c option and passing the arguments as an array.

To fix the problem, we should avoid constructing the shell command as a single string that the shell interprets. Instead, we should use spawnSync with separate arguments to ensure that the file path is not interpreted by the shell. This can be achieved by passing the command and its arguments as separate elements in an array.

To fix the problem, we need to adjust the order of unescaping in the htmlRestore function. Specifically, we should unescape the ampersand (&) last to ensure that other entities are correctly unescaped first. This change will prevent any issues related to double unescaping.

To fix the problem, we need to modify the regular expression to remove the ambiguity that causes exponential backtracking. Specifically, we can replace the .* and .+ patterns with more specific patterns that do not overlap in ambiguous ways. This can be achieved by using negated character classes to ensure that each part of the regular expression matches a distinct set of characters.

• Replace .* with [^:]* to match any sequence of characters that does not include a colon.
• Replace .+ with [^"]+ to match any sequence of characters that does not include a double quote.

These changes will ensure that the regular expression is more efficient and does not suffer from exponential backtracking.

To fix the problem, we need to ensure that the name property from applicationMeta cannot be used to modify Object.prototype. This can be achieved by checking if name is one of the dangerous values (__proto__, constructor, prototype) before using it as a key in the assignment. If name matches any of these values, we should throw an error or handle it appropriately.

To fix the problem, we need to ensure that applicationName cannot be a dangerous value like __proto__, constructor, or prototype. One way to do this is to validate applicationName before using it as a key in an object assignment. We can add a check to ensure that applicationName does not match any of these dangerous values. If it does, we can throw an error or handle it appropriately.