vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-04-26 11:00:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

fix(security): replace fragile printenv with eval parameter expansion in timeout functions (#3238)

Browse source 
The get_provision_timeout and get_agent_timeout functions used printenv with
dynamically constructed variable names, which is fragile across shells and
platforms. Replace with eval-based parameter expansion using the already-
sanitized safe_agent variable (restricted to [A-Za-z0-9_]).

Fixes #3234

Agent: security-auditor

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
A 2026-04-08 01:44:43 -07:00 • committed by GitHub
parent 1745b78689
commit 8c73bb9713
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 10 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

16
sh/e2e/lib/common.sh
View file

@ -168,9 +168,11 @@ get_provision_timeout() {
local safe_agent
safe_agent=$(printf '%s' "${agent}" | sed 's/[^A-Za-z0-9_]/_/g')
# Check for env var override: PROVISION_TIMEOUT_<agent> (printenv, no eval)
local env_val
env_val=$(printenv "PROVISION_TIMEOUT_${safe_agent}" 2>/dev/null) || env_val=""
# Check for env var override: PROVISION_TIMEOUT_<agent>
# Use eval with safe_agent (already sanitized to [A-Za-z0-9_]) for reliable
# variable lookup — printenv is fragile across shells and platforms.
local env_val=""
eval "env_val=\${PROVISION_TIMEOUT_${safe_agent}:-}"
if [ -n "${env_val}" ]; then
case "${env_val}" in ''|*[!0-9]*) ;; *) printf '%s' "${env_val}"; return ;; esac
fi
@ -204,9 +206,11 @@ get_agent_timeout() {
local safe_agent
safe_agent=$(printf '%s' "${agent}" | sed 's/[^A-Za-z0-9_]/_/g')
# Check for env var override: AGENT_TIMEOUT_<agent> (printenv, no eval)
local env_val
env_val=$(printenv "AGENT_TIMEOUT_${safe_agent}" 2>/dev/null) || env_val=""
# Check for env var override: AGENT_TIMEOUT_<agent>
# Use eval with safe_agent (already sanitized to [A-Za-z0-9_]) for reliable
# variable lookup — printenv is fragile across shells and platforms.
local env_val=""
eval "env_val=\${AGENT_TIMEOUT_${safe_agent}:-}"
if [ -n "${env_val}" ]; then
case "${env_val}" in ''|*[!0-9]*) ;; *) printf '%s' "${env_val}"; return ;; esac
fi