mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-04-28 11:59:29 +00:00
e8dc7b4752
8 scripts were embedding OPENROUTER_API_KEY directly into shell command
strings passed to run_server/run_in_codespace, allowing command injection
if the API key contains shell metacharacters (single quotes, semicolons,
backticks, etc.).
The worst case was latitude/continue.sh which had zero quoting:
export OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
allowing arbitrary command execution on the remote server with a
crafted API key value.
Fixed by replacing unsafe inline patterns with the existing secure
helpers (inject_env_vars_ssh, inject_env_vars_local, inject_env_vars)
which use generate_env_config to properly single-quote values with
embedded quote escaping.
Affected scripts:
- scaleway/continue.sh (single-quote breakout)
- upcloud/continue.sh (double-quote breakout)
- e2b/continue.sh (single-quote breakout)
- modal/continue.sh (single-quote breakout)
- daytona/continue.sh (single-quote breakout)
- latitude/continue.sh (no quoting at all - critical)
- github-codespaces/continue.sh (single-quote breakout)
- kamatera/nanoclaw.sh (single-quote breakout in .env write)
Agent: security-auditor
Co-authored-by: A <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
54 lines
1.5 KiB
Bash
54 lines
1.5 KiB
Bash
#!/bin/bash
|
|
# shellcheck disable=SC2154
|
|
set -eo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
|
|
# shellcheck source=github-codespaces/lib/common.sh
|
|
|
|
if [[ -f "${SCRIPT_DIR}/lib/common.sh" ]]; then
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
else
|
|
eval "$(curl -fsSL https://raw.githubusercontent.com/OpenRouterTeam/spawn/main/github-codespaces/lib/common.sh)"
|
|
fi
|
|
|
|
log_info "Continue on GitHub Codespaces"
|
|
echo ""
|
|
|
|
ensure_gh_cli
|
|
ensure_gh_auth
|
|
|
|
REPO="${GH_CODESPACE_REPO:-OpenRouterTeam/spawn}"
|
|
MACHINE="${GH_CODESPACE_MACHINE:-basicLinux32gb}"
|
|
IDLE_TIMEOUT="${GH_CODESPACE_IDLE_TIMEOUT:-30m}"
|
|
|
|
CODESPACE_NAME=$(create_codespace "${REPO}" "${MACHINE}" "${IDLE_TIMEOUT}")
|
|
export CODESPACE_NAME
|
|
|
|
wait_for_codespace "${CODESPACE_NAME}"
|
|
|
|
log_step "Installing Continue CLI..."
|
|
run_in_codespace "${CODESPACE_NAME}" "npm install -g @continuedev/cli"
|
|
log_info "Continue installed"
|
|
|
|
echo ""
|
|
if [[ -n "${OPENROUTER_API_KEY:-}" ]]; then
|
|
log_info "Using OpenRouter API key from environment"
|
|
else
|
|
OPENROUTER_API_KEY=$(get_openrouter_api_key_oauth 5180)
|
|
fi
|
|
|
|
log_step "Setting up environment variables..."
|
|
inject_env_vars \
|
|
"OPENROUTER_API_KEY=${OPENROUTER_API_KEY}"
|
|
|
|
setup_continue_config "${OPENROUTER_API_KEY}" "upload_file" "run_server"
|
|
|
|
echo ""
|
|
log_info "Codespace setup completed successfully!"
|
|
log_info "Codespace: ${CODESPACE_NAME}"
|
|
echo ""
|
|
|
|
log_step "Starting Continue CLI in TUI mode..."
|
|
sleep 1
|
|
clear
|
|
gh codespace ssh --codespace "${CODESPACE_NAME}" -- "source ~/.zshrc && cn"
|