vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-05-10 20:39:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

fix: use safe inject_env_vars helpers instead of raw shell interpolation (#932)

Browse source 
Replace unsafe heredoc/echo patterns with inject_env_vars_ssh (Atlantic.Net)
and inject_env_vars_local (CodeSandbox) for API key injection. The previous
patterns embedded OPENROUTER_API_KEY values directly into shell command strings
without escaping, allowing potential command injection if the API key contained
shell metacharacters (quotes, backticks, dollar signs).

Affected scripts (11 total):
- atlanticnet: codex, continue, gemini, gptme, kilocode, opencode
- codesandbox: amazonq, gemini, goose, opencode, plandex

The safe helpers (generate_env_config) properly single-quote all values and
escape embedded single quotes, preventing shell interpretation of special chars.

Agent: security-auditor

Co-authored-by: A <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
A 2026-02-13 05:57:06 -08:00 • committed by GitHub
parent bcb2d63f35
commit d785571026
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 43 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

11
atlanticnet/codex.sh
View file

@ -31,11 +31,10 @@ else
fi
log_step "Setting up environment variables..."
run_server "${ATLANTICNET_SERVER_IP}" "cat >> ~/.bashrc << 'EOF'
export OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
export OPENAI_API_KEY=${OPENROUTER_API_KEY}
export OPENAI_BASE_URL=https://openrouter.ai/api/v1
EOF"
inject_env_vars_ssh "${ATLANTICNET_SERVER_IP}" upload_file run_server \
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" \
"OPENAI_API_KEY=${OPENROUTER_API_KEY}" \
"OPENAI_BASE_URL=https://openrouter.ai/api/v1"
echo ""
log_info "Server setup completed successfully!"
@ -44,4 +43,4 @@ echo ""
log_step "Starting Codex..."
sleep 1
clear
interactive_session "${ATLANTICNET_SERVER_IP}" "source ~/.bashrc && codex"
interactive_session "${ATLANTICNET_SERVER_IP}" "source ~/.zshrc && codex"

7
atlanticnet/continue.sh
View file

@ -31,9 +31,8 @@ else
fi
log_step "Setting up environment variables..."
run_server "${ATLANTICNET_SERVER_IP}" "cat >> ~/.bashrc << 'EOF'
export OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
EOF"
inject_env_vars_ssh "${ATLANTICNET_SERVER_IP}" upload_file run_server \
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}"
setup_continue_config "${OPENROUTER_API_KEY}" \
"upload_file ${ATLANTICNET_SERVER_IP}" \
@ -46,4 +45,4 @@ echo ""
log_step "Starting Continue CLI in TUI mode..."
sleep 1
clear
interactive_session "${ATLANTICNET_SERVER_IP}" "source ~/.bashrc && cn"
interactive_session "${ATLANTICNET_SERVER_IP}" "source ~/.zshrc && cn"

13
atlanticnet/gemini.sh
View file

@ -31,12 +31,11 @@ else
fi
log_step "Setting up environment variables..."
run_server "${ATLANTICNET_SERVER_IP}" "cat >> ~/.bashrc << 'EOF'
export OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
export GEMINI_API_KEY=${OPENROUTER_API_KEY}
export OPENAI_API_KEY=${OPENROUTER_API_KEY}
export OPENAI_BASE_URL=https://openrouter.ai/api/v1
EOF"
inject_env_vars_ssh "${ATLANTICNET_SERVER_IP}" upload_file run_server \
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" \
"GEMINI_API_KEY=${OPENROUTER_API_KEY}" \
"OPENAI_API_KEY=${OPENROUTER_API_KEY}" \
"OPENAI_BASE_URL=https://openrouter.ai/api/v1"
echo ""
log_info "Server setup completed successfully!"
@ -45,4 +44,4 @@ echo ""
log_step "Starting Gemini..."
sleep 1
clear
interactive_session "${ATLANTICNET_SERVER_IP}" "source ~/.bashrc && gemini"
interactive_session "${ATLANTICNET_SERVER_IP}" "source ~/.zshrc && gemini"

7
atlanticnet/gptme.sh
View file

@ -39,9 +39,8 @@ fi
MODEL_ID=$(get_model_id_interactive "openrouter/auto" "gptme") || exit 1
log_step "Setting up environment variables..."
run_server "${ATLANTICNET_SERVER_IP}" "cat >> ~/.bashrc << 'EOF'
export OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
EOF"
inject_env_vars_ssh "${ATLANTICNET_SERVER_IP}" upload_file run_server \
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}"
echo ""
log_info "Server setup completed successfully!"
@ -50,4 +49,4 @@ echo ""
log_step "Starting gptme..."
sleep 1
clear
interactive_session "${ATLANTICNET_SERVER_IP}" "source ~/.bashrc && gptme -m openrouter/${MODEL_ID}"
interactive_session "${ATLANTICNET_SERVER_IP}" "source ~/.zshrc && gptme -m openrouter/${MODEL_ID}"

11
atlanticnet/kilocode.sh
View file

@ -31,11 +31,10 @@ else
fi
log_step "Setting up environment variables..."
run_server "${ATLANTICNET_SERVER_IP}" "cat >> ~/.bashrc << 'EOF'
export OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
export KILO_PROVIDER_TYPE=openrouter
export KILO_OPEN_ROUTER_API_KEY=${OPENROUTER_API_KEY}
EOF"
inject_env_vars_ssh "${ATLANTICNET_SERVER_IP}" upload_file run_server \
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" \
"KILO_PROVIDER_TYPE=openrouter" \
"KILO_OPEN_ROUTER_API_KEY=${OPENROUTER_API_KEY}"
echo ""
log_info "Server setup completed successfully!"
@ -44,4 +43,4 @@ echo ""
log_step "Starting Kilo Code..."
sleep 1
clear
interactive_session "${ATLANTICNET_SERVER_IP}" "source ~/.bashrc && kilocode"
interactive_session "${ATLANTICNET_SERVER_IP}" "source ~/.zshrc && kilocode"

7
atlanticnet/opencode.sh
View file

@ -32,9 +32,8 @@ else
fi
log_step "Setting up environment variables..."
run_server "${ATLANTICNET_SERVER_IP}" "cat >> ~/.bashrc << 'EOF'
export OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
EOF"
inject_env_vars_ssh "${ATLANTICNET_SERVER_IP}" upload_file run_server \
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}"
echo ""
log_info "Server setup completed successfully!"
@ -43,4 +42,4 @@ echo ""
log_step "Starting OpenCode..."
sleep 1
clear
interactive_session "${ATLANTICNET_SERVER_IP}" "source ~/.bashrc && opencode"
interactive_session "${ATLANTICNET_SERVER_IP}" "source ~/.zshrc && opencode"

7
codesandbox/amazonq.sh
View file

@ -29,9 +29,10 @@ else
fi
log_step "Setting up environment variables..."
run_server 'echo "export OPENROUTER_API_KEY=\"'"${OPENROUTER_API_KEY}"'\"" >> ~/.bashrc'
run_server 'echo "export OPENAI_API_KEY=\"'"${OPENROUTER_API_KEY}"'\"" >> ~/.bashrc'
run_server 'echo "export OPENAI_BASE_URL=\"https://openrouter.ai/api/v1\"" >> ~/.bashrc'
inject_env_vars_local upload_file run_server \
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" \
"OPENAI_API_KEY=${OPENROUTER_API_KEY}" \
"OPENAI_BASE_URL=https://openrouter.ai/api/v1"
echo ""
log_info "CodeSandbox setup completed successfully!"

9
codesandbox/gemini.sh
View file

@ -29,10 +29,11 @@ else
fi
log_step "Setting up environment variables..."
run_server 'echo "export OPENROUTER_API_KEY=\"'"${OPENROUTER_API_KEY}"'\"" >> ~/.bashrc'
run_server 'echo "export GEMINI_API_KEY=\"'"${OPENROUTER_API_KEY}"'\"" >> ~/.bashrc'
run_server 'echo "export OPENAI_API_KEY=\"'"${OPENROUTER_API_KEY}"'\"" >> ~/.bashrc'
run_server 'echo "export OPENAI_BASE_URL=\"https://openrouter.ai/api/v1\"" >> ~/.bashrc'
inject_env_vars_local upload_file run_server \
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" \
"GEMINI_API_KEY=${OPENROUTER_API_KEY}" \
"OPENAI_API_KEY=${OPENROUTER_API_KEY}" \
"OPENAI_BASE_URL=https://openrouter.ai/api/v1"
echo ""
log_info "CodeSandbox setup completed successfully!"

5
codesandbox/goose.sh
View file

@ -29,8 +29,9 @@ else
fi
log_step "Setting up environment variables..."
run_server 'echo "export OPENROUTER_API_KEY=\"'"${OPENROUTER_API_KEY}"'\"" >> ~/.bashrc'
run_server 'echo "export GOOSE_PROVIDER=\"openrouter\"" >> ~/.bashrc'
inject_env_vars_local upload_file run_server \
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" \
"GOOSE_PROVIDER=openrouter"
echo ""
log_info "CodeSandbox setup completed successfully!"

3
codesandbox/opencode.sh
View file

@ -29,7 +29,8 @@ else
fi
log_step "Setting up environment variables..."
run_server 'echo "export OPENROUTER_API_KEY=\"'"${OPENROUTER_API_KEY}"'\"" >> ~/.bashrc'
inject_env_vars_local upload_file run_server \
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}"
echo ""
log_info "CodeSandbox setup completed successfully!"

7
codesandbox/plandex.sh
View file

@ -29,9 +29,10 @@ else
fi
log_step "Setting up environment variables..."
run_server 'echo "export OPENROUTER_API_KEY=\"'"${OPENROUTER_API_KEY}"'\"" >> ~/.bashrc'
run_server 'echo "export OPENAI_API_KEY=\"'"${OPENROUTER_API_KEY}"'\"" >> ~/.bashrc'
run_server 'echo "export OPENAI_BASE_URL=\"https://openrouter.ai/api/v1\"" >> ~/.bashrc'
inject_env_vars_local upload_file run_server \
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" \
"OPENAI_API_KEY=${OPENROUTER_API_KEY}" \
"OPENAI_BASE_URL=https://openrouter.ai/api/v1"
echo ""
log_info "CodeSandbox setup completed successfully!"