From e8dc7b4752c6e1915118aa39260e1e4568ee13da Mon Sep 17 00:00:00 2001 From: A <258483684+la14-1@users.noreply.github.com> Date: Thu, 12 Feb 2026 15:03:12 -0800 Subject: [PATCH] fix: replace unsafe inline API key injection with secure helpers (#676) 8 scripts were embedding OPENROUTER_API_KEY directly into shell command strings passed to run_server/run_in_codespace, allowing command injection if the API key contains shell metacharacters (single quotes, semicolons, backticks, etc.). The worst case was latitude/continue.sh which had zero quoting: export OPENROUTER_API_KEY=${OPENROUTER_API_KEY} allowing arbitrary command execution on the remote server with a crafted API key value. Fixed by replacing unsafe inline patterns with the existing secure helpers (inject_env_vars_ssh, inject_env_vars_local, inject_env_vars) which use generate_env_config to properly single-quote values with embedded quote escaping. Affected scripts: - scaleway/continue.sh (single-quote breakout) - upcloud/continue.sh (double-quote breakout) - e2b/continue.sh (single-quote breakout) - modal/continue.sh (single-quote breakout) - daytona/continue.sh (single-quote breakout) - latitude/continue.sh (no quoting at all - critical) - github-codespaces/continue.sh (single-quote breakout) - kamatera/nanoclaw.sh (single-quote breakout in .env write) Agent: security-auditor Co-authored-by: A <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 --- daytona/continue.sh | 4 ++-- e2b/continue.sh | 4 ++-- github-codespaces/continue.sh | 4 ++-- kamatera/nanoclaw.sh | 8 ++++++-- latitude/continue.sh | 4 ++-- modal/continue.sh | 4 ++-- scaleway/continue.sh | 4 ++-- upcloud/continue.sh | 4 ++-- 8 files changed, 20 insertions(+), 16 deletions(-) diff --git a/daytona/continue.sh b/daytona/continue.sh index 0f81b9ff..2c85f4aa 100644 --- a/daytona/continue.sh +++ b/daytona/continue.sh @@ -29,8 +29,8 @@ else fi log_step "Setting up environment variables..." -run_server "printf 'export OPENROUTER_API_KEY=%s\n' '${OPENROUTER_API_KEY}' >> ~/.bashrc" -run_server "printf 'export OPENROUTER_API_KEY=%s\n' '${OPENROUTER_API_KEY}' >> ~/.zshrc" +inject_env_vars_local upload_file run_server \ + "OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" setup_continue_config "${OPENROUTER_API_KEY}" "upload_file" "run_server" diff --git a/e2b/continue.sh b/e2b/continue.sh index b85bfc75..78a5672a 100644 --- a/e2b/continue.sh +++ b/e2b/continue.sh @@ -33,8 +33,8 @@ else fi log_step "Setting up environment variables..." -run_server "printf 'export OPENROUTER_API_KEY=\"%s\"\n' '${OPENROUTER_API_KEY}' >> ~/.bashrc" -run_server "printf 'export OPENROUTER_API_KEY=\"%s\"\n' '${OPENROUTER_API_KEY}' >> ~/.zshrc" +inject_env_vars_local upload_file run_server \ + "OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" setup_continue_config "${OPENROUTER_API_KEY}" "upload_file" "run_server" diff --git a/github-codespaces/continue.sh b/github-codespaces/continue.sh index cb2aaa86..28a90d3e 100644 --- a/github-codespaces/continue.sh +++ b/github-codespaces/continue.sh @@ -38,8 +38,8 @@ else fi log_step "Setting up environment variables..." -run_in_codespace "${CODESPACE_NAME}" "printf 'export OPENROUTER_API_KEY=\"%s\"\n' '${OPENROUTER_API_KEY}' >> ~/.bashrc" -run_in_codespace "${CODESPACE_NAME}" "printf 'export OPENROUTER_API_KEY=\"%s\"\n' '${OPENROUTER_API_KEY}' >> ~/.zshrc" +inject_env_vars \ + "OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" setup_continue_config "${OPENROUTER_API_KEY}" "upload_file" "run_server" diff --git a/kamatera/nanoclaw.sh b/kamatera/nanoclaw.sh index f3006733..c9ec6077 100644 --- a/kamatera/nanoclaw.sh +++ b/kamatera/nanoclaw.sh @@ -39,8 +39,12 @@ inject_env_vars_ssh "${KAMATERA_SERVER_IP}" upload_file run_server \ "ANTHROPIC_API_KEY=${OPENROUTER_API_KEY}" \ "ANTHROPIC_BASE_URL=https://openrouter.ai/api" -# Write .env file for NanoClaw -run_server "${KAMATERA_SERVER_IP}" "printf 'ANTHROPIC_API_KEY=%s\n' '${OPENROUTER_API_KEY}' > ~/nanoclaw/.env" +# Write .env file for NanoClaw (use temp file + upload to avoid shell injection) +DOTENV_TEMP=$(mktemp) +chmod 600 "${DOTENV_TEMP}" +track_temp_file "${DOTENV_TEMP}" +printf 'ANTHROPIC_API_KEY=%s\n' "${OPENROUTER_API_KEY}" > "${DOTENV_TEMP}" +upload_file "${KAMATERA_SERVER_IP}" "${DOTENV_TEMP}" "/root/nanoclaw/.env" echo "" log_info "Kamatera server setup completed successfully!" diff --git a/latitude/continue.sh b/latitude/continue.sh index 2034e7c6..dfc5fb0c 100644 --- a/latitude/continue.sh +++ b/latitude/continue.sh @@ -32,8 +32,8 @@ else fi log_step "Setting up environment variables..." -run_server "$LATITUDE_SERVER_IP" "printf '%s\n' 'export OPENROUTER_API_KEY=${OPENROUTER_API_KEY}' >> /root/.bashrc" -run_server "$LATITUDE_SERVER_IP" "printf '%s\n' 'export OPENROUTER_API_KEY=${OPENROUTER_API_KEY}' >> /root/.zshrc" +inject_env_vars_ssh "${LATITUDE_SERVER_IP}" upload_file run_server \ + "OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" setup_continue_config "${OPENROUTER_API_KEY}" \ "upload_file ${LATITUDE_SERVER_IP}" \ diff --git a/modal/continue.sh b/modal/continue.sh index c3e5f9bb..10468f14 100644 --- a/modal/continue.sh +++ b/modal/continue.sh @@ -32,8 +32,8 @@ else fi log_step "Setting up environment variables..." -run_server "printf 'export OPENROUTER_API_KEY=\"%s\"\n' '${OPENROUTER_API_KEY}' >> ~/.bashrc" -run_server "printf 'export OPENROUTER_API_KEY=\"%s\"\n' '${OPENROUTER_API_KEY}' >> ~/.zshrc" +inject_env_vars_local upload_file run_server \ + "OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" setup_continue_config "${OPENROUTER_API_KEY}" "upload_file" "run_server" diff --git a/scaleway/continue.sh b/scaleway/continue.sh index 9fc667da..fa9fdfbf 100644 --- a/scaleway/continue.sh +++ b/scaleway/continue.sh @@ -34,8 +34,8 @@ else fi log_step "Setting up environment variables..." -run_server "${SCALEWAY_SERVER_IP}" "printf 'export OPENROUTER_API_KEY=\"%s\"\n' '${OPENROUTER_API_KEY}' >> /root/.bashrc" -run_server "${SCALEWAY_SERVER_IP}" "printf 'export OPENROUTER_API_KEY=\"%s\"\n' '${OPENROUTER_API_KEY}' >> /root/.zshrc" +inject_env_vars_ssh "${SCALEWAY_SERVER_IP}" upload_file run_server \ + "OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" setup_continue_config "${OPENROUTER_API_KEY}" \ "upload_file ${SCALEWAY_SERVER_IP}" \ diff --git a/upcloud/continue.sh b/upcloud/continue.sh index 6f940843..ee3d4f1e 100644 --- a/upcloud/continue.sh +++ b/upcloud/continue.sh @@ -31,8 +31,8 @@ else fi log_step "Setting up environment variables..." -run_server "$UPCLOUD_SERVER_IP" "printf '%s\n' 'export OPENROUTER_API_KEY=\"${OPENROUTER_API_KEY}\"' >> /root/.bashrc" -run_server "$UPCLOUD_SERVER_IP" "printf '%s\n' 'export OPENROUTER_API_KEY=\"${OPENROUTER_API_KEY}\"' >> /root/.zshrc" +inject_env_vars_ssh "${UPCLOUD_SERVER_IP}" upload_file run_server \ + "OPENROUTER_API_KEY=${OPENROUTER_API_KEY}" setup_continue_config "${OPENROUTER_API_KEY}" \ "upload_file ${UPCLOUD_SERVER_IP}" \