VM-1450: Harden CLI injection guards for Add Keeper Record (2.0.3)

[idimov-keeper]

Attribute and regression-test the Add Keeper Record shell-injection fix; tighten Update UID and Generate password boundaries.

Summary:

• Primary mitigations already on main branch (requireSafe, assertSingleLine, quote escaping) — this branch attributes VM-1450 / CWE-78, adds Step A/B regression tests, and ships 2.0.3 release notes.
• Residual hardening: Update Record requires a valid 22-char UID before lookup; Generate Secrets runs requireSafe on the generated password before CLI embed.
• Closes command injection via crafted editor selection when piping to the persistent Keeper shell (same pattern covered on Update / Generate).

[github-actions]

Qodana Community for JVM

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

• Register at Qodana Cloud and configure the action
• Use GitHub Code Scanning with Qodana
• Host Qodana report at GitHub Pages
• Inspect and use qodana.sarif.json (see the Qodana SARIF format for details)

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2025.1.1
        with:
          upload-result: true

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions

[pkamble-ks]

LGTM for VM-1450. Residual UID check + generated-password requireSafe + Step A/B regression tests look solid. Primary Add injection guards already on main.

@stas-schaller please review once when you have a chance before we ship 2.0.3.