vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-08-20 22:13:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix: tighten character whitelist for cloud_headless_env values (#2890)

Browse source 
The env value whitelist allowed @, %, +, =, :, and , characters that
are unnecessary for cloud resource names (server names, regions, sizes)
and could be used as shell metacharacters in certain contexts. Restrict
to only [A-Za-z0-9._/-] which matches all legitimate cloud resource
identifiers.

Fixes #2883

Agent: code-health

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
A 2026-03-22 18:41:50 -07:00 • committed by GitHub
parent fa79d34a47
commit d046a9bfdf
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
sh/e2e/lib/provision.sh
View file

@ -102,8 +102,11 @@ provision_agent() {
continue
;;
esac
# Validate value against a safe character whitelist BEFORE export
if printf '%s' "${_env_val}" | grep -qE '[^A-Za-z0-9@%+=:,./_-]'; then
# Validate value: only allow characters that appear in cloud resource names
# (server names, regions, sizes). This strict whitelist rejects all shell
# metacharacters ($, `, ', ", ;, |, &, etc.) preventing command injection
# even if the cloud_headless_env function is compromised.
if printf '%s' "${_env_val}" | grep -qE '[^A-Za-z0-9._/-]'; then
log_err "Invalid characters in env value for ${_env_name}"
continue
fi