5212644861
Validate that the username portion of ~username paths contains only
valid characters (alphanumeric, dot, hyphen, underscore) before passing
to shell echo for expansion. Previously, paths like '~; rm -rf /'
would be passed unquoted to self._exec(f'echo {path}'), allowing
arbitrary command execution.
The approach validates the username rather than using shlex.quote(),
which would prevent tilde expansion from working at all since
echo '~user' outputs the literal string instead of expanding it.
Added tests for injection blocking and valid ~username/path expansion.
Credit to @alireza78a for reporting (PR #442, issue #442).
|
||
|---|---|---|
| .. | ||
| __init__.py | ||
| test_approval.py | ||
| test_browser_console.py | ||
| test_clarify_tool.py | ||
| test_clipboard.py | ||
| test_code_execution.py | ||
| test_cron_prompt_injection.py | ||
| test_cronjob_tools.py | ||
| test_daytona_environment.py | ||
| test_debug_helpers.py | ||
| test_delegate.py | ||
| test_file_operations.py | ||
| test_file_tools.py | ||
| test_file_tools_live.py | ||
| test_force_dangerous_override.py | ||
| test_fuzzy_match.py | ||
| test_hidden_dir_filter.py | ||
| test_homeassistant_tool.py | ||
| test_interrupt.py | ||
| test_mcp_tool.py | ||
| test_memory_tool.py | ||
| test_patch_parser.py | ||
| test_process_registry.py | ||
| test_registry.py | ||
| test_session_search.py | ||
| test_skill_manager_tool.py | ||
| test_skill_view_path_check.py | ||
| test_skill_view_traversal.py | ||
| test_skills_guard.py | ||
| test_skills_hub.py | ||
| test_skills_hub_clawhub.py | ||
| test_skills_sync.py | ||
| test_skills_tool.py | ||
| test_symlink_prefix_confusion.py | ||
| test_terminal_disk_usage.py | ||
| test_todo_tool.py | ||
| test_vision_tools.py | ||
| test_web_tools_config.py | ||
| test_windows_compat.py | ||
| test_write_deny.py | ||