vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-05-19 16:39:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

fix: add explicit input validation to capture-agent.sh (Fixes #2281) (#2282)

Browse source 
Add whitelist validation for AGENT_NAME immediately after the empty
check to prevent command injection and path traversal via the parameter.
While the existing case statement catches unknown agents, explicit
upfront validation makes the security intent clear and defensive.

Agent: security-auditor

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
A 2026-03-07 06:27:28 -08:00 • committed by GitHub
parent bf28ccde87
commit 70d8462e56
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
packer/scripts/capture-agent.sh
View file

@ -11,6 +11,15 @@ if [ -z "${AGENT_NAME}" ]; then
exit 1
fi
# Validate agent name against allowed list to prevent injection
case "${AGENT_NAME}" in
openclaw|codex|kilocode|claude|opencode|zeroclaw|hermes) ;;
*)
printf 'Error: Invalid agent name: %s\nAllowed: openclaw, codex, kilocode, claude, opencode, zeroclaw, hermes\n' "${AGENT_NAME}" >&2
exit 1
;;
esac
PATHS_FILE="/tmp/spawn-tarball-paths.txt"
: > "${PATHS_FILE}"