vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-05-20 01:11:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

fix(security): validate server_id in cmdConnect and cmdEnterAgent (#1925)

Browse source 
All other connection fields (ip, user, server_name) are validated
against injection before being passed to shell commands, but server_id
was skipped in both cmdConnect and cmdEnterAgent despite being used as
a daytona ssh argument (line 2922). This inconsistency existed while
execDeleteServer, mergeLastConnection, and the headless code path all
correctly validated server_id.

Adds the missing `if (connection.server_id) { validateServerIdentifier(...) }`
guard in both functions, matching the existing server_name pattern.

Agent: security-auditor

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
A 2026-02-25 09:56:57 -08:00 • committed by GitHub
parent f9c1568f9c
commit 7a5e7580bd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
packages/cli/package.json
View file

@ -1,6 +1,6 @@
{
"name": "@openrouter/spawn",
"version": "0.10.11",
"version": "0.10.12",
"type": "module",
"bin": {
"spawn": "cli.js"

6
packages/cli/src/commands.ts
View file

@ -2766,6 +2766,9 @@ async function cmdConnect(connection: VMConnection): Promise<void> {
if (connection.server_name) {
validateServerIdentifier(connection.server_name);
}
if (connection.server_id) {
validateServerIdentifier(connection.server_id);
}
} catch (err) {
p.log.error(`Security validation failed: ${getErrorMessage(err)}`);
p.log.info("Your spawn history file may be corrupted or tampered with.");
@ -2830,6 +2833,9 @@ async function cmdEnterAgent(connection: VMConnection, agentKey: string, manifes
if (connection.server_name) {
validateServerIdentifier(connection.server_name);
}
if (connection.server_id) {
validateServerIdentifier(connection.server_id);
}
} catch (err) {
p.log.error(`Security validation failed: ${getErrorMessage(err)}`);
p.log.info("Your spawn history file may be corrupted or tampered with.");