vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-04-28 11:59:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

fix(security): add base64 validation guards in orchestrate.ts (fixes #3006) (#3007)
Some checks are pending
CLI Release / Build and release CLI (push) Waiting to run
Details
Lint / ShellCheck (push) Waiting to run
Details
Lint / Biome Lint (push) Waiting to run
Details
Lint / macOS Compatibility (push) Waiting to run
Details

Browse source 
Add /^[A-Za-z0-9+/=]+$/ validation after each .toString("base64") call
in delegateCloudCredentials() and injectEnvVars(), consistent with the
pattern established in agent-setup.ts by #2988.

Agent: security-auditor

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
A 2026-03-26 04:25:40 -07:00 • committed by GitHub
parent 463b8398f2
commit fd36ff0e3d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
packages/cli/src/shared/orchestrate.ts
View file

@ -191,6 +191,9 @@ export async function delegateCloudCredentials(runner: CloudRunner, _cloudName:
for (const file of filesToDelegate) {
const content = readFileSync(file.localPath, "utf-8");
const b64 = Buffer.from(content).toString("base64");
if (!/^[A-Za-z0-9+/=]+$/.test(b64)) {
throw new Error("Unexpected characters in base64 output");
}
const writeResult = await asyncTryCatch(() =>
runner.runServer(`printf '%s' '${b64}' | base64 -d > ${file.remotePath} && chmod 600 ${file.remotePath}`),
);
@ -498,6 +501,9 @@ export async function runOrchestration(
async function injectEnvVars(cloud: CloudOrchestrator, envContent: string): Promise<void> {
logStep("Setting up environment variables...");
const envB64 = Buffer.from(envContent).toString("base64");
if (!/^[A-Za-z0-9+/=]+$/.test(envB64)) {
throw new Error("Unexpected characters in base64 output");
}
const isLocalWindows = cloud.cloudName === "local" && isWindows();
const envSetupCmd = isLocalWindows