vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-04-30 12:59:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10
spawn/sprite
History
LAB d76c8dba0f
Security: fix critical command injection vulnerabilities in container providers (#54) 
* refactor: Simplify API call retry logic in generic_cloud_api

Extract duplicated retry handling into focused helper functions:
- handle_api_network_error(): Handles curl errors with retry logic
- handle_api_transient_error(): Handles 429/503 HTTP errors
- _call_cloud_api(): Internal curl wrapper separating concerns

Reduces cyclomatic complexity of generic_cloud_api from 9 to 3.
Lines reduced from 89 to 54 (40% reduction).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* Security: fix critical command injection vulnerabilities in container providers

CRITICAL SECURITY FIX - Command injection vulnerabilities

Fixed command injection in bash -c calls across all container/sandbox providers.
These functions were passing commands directly to bash -c without proper escaping,
allowing potential remote code execution via crafted inputs.

Files fixed:
- sprite/lib/common.sh: run_sprite(), upload_file_sprite()
- e2b/lib/common.sh: run_server(), upload_file(), interactive_session()
- daytona/lib/common.sh: run_server(), upload_file(), interactive_session()
- railway/lib/common.sh: run_server(), upload_file(), interactive_session()

Fix: Use printf %q to properly escape all command arguments before passing to bash -c.
This prevents command injection while maintaining functionality.

Severity: CRITICAL (CVSS 9.8)
Impact: Remote code execution, full system compromise
Mitigation: Proper shell escaping using printf %q

All modified files pass bash -n syntax validation.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Sprite <noreply@sprite.dev>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-08 12:00:43 -08:00
..
.claude/rules Sprite setup scripts for Claude Code and OpenClaw 2026-02-05 13:25:30 -06:00
lib Security: fix critical command injection vulnerabilities in container providers (#54) 2026-02-08 12:00:43 -08:00
aider.sh Add non-interactive mode for agent execution (#35) 2026-02-07 21:20:34 -08:00
amazonq.sh refactor: Extract ENV_TEMP pattern to provider-specific inject functions 2026-02-08 04:15:02 +00:00
claude.sh fix: Fix 4 failing claude.sh tests 2026-02-08 18:26:53 +00:00
cline.sh refactor: Extract ENV_TEMP pattern to provider-specific inject functions 2026-02-08 04:15:02 +00:00
codex.sh refactor: add pipefail to error handling flags 2026-02-08 02:34:45 +00:00
gemini.sh refactor: Extract ENV_TEMP pattern to provider-specific inject functions 2026-02-08 04:15:02 +00:00
goose.sh refactor: add pipefail to error handling flags 2026-02-08 02:34:45 +00:00
gptme.sh Add guardrails: CLAUDE.md rules, hooks, pre-commit validation (#33) 2026-02-07 20:02:19 -08:00
interpreter.sh refactor: add pipefail to error handling flags 2026-02-08 02:34:45 +00:00
nanoclaw.sh Fix config file paths and missing OPENROUTER_API_KEY env check 2026-02-08 05:13:37 +00:00
openclaw.sh Fix config file paths and missing OPENROUTER_API_KEY env check 2026-02-08 05:13:37 +00:00
opencode.sh fix: Use robust OpenCode install method across all clouds (#48) 2026-02-07 23:02:18 -08:00
plandex.sh Add Plandex coding agent with 14 cloud implementations (#36) 2026-02-07 21:35:04 -08:00
README.md Add E2B + Modal sandbox providers, restructure README (#22) 2026-02-07 14:11:04 -08:00

README.md

Sprite

Sprites.dev managed VMs with CLI. Sprite

Agents

Claude Code

bash <(curl -fsSL https://openrouter.ai/lab/spawn/sprite/claude.sh)

OpenClaw

bash <(curl -fsSL https://openrouter.ai/lab/spawn/sprite/openclaw.sh)

NanoClaw

bash <(curl -fsSL https://openrouter.ai/lab/spawn/sprite/nanoclaw.sh)

Aider

bash <(curl -fsSL https://openrouter.ai/lab/spawn/sprite/aider.sh)

Goose

bash <(curl -fsSL https://openrouter.ai/lab/spawn/sprite/goose.sh)

Codex CLI

bash <(curl -fsSL https://openrouter.ai/lab/spawn/sprite/codex.sh)

Open Interpreter

bash <(curl -fsSL https://openrouter.ai/lab/spawn/sprite/interpreter.sh)

Gemini CLI

bash <(curl -fsSL https://openrouter.ai/lab/spawn/sprite/gemini.sh)

Amazon Q CLI

bash <(curl -fsSL https://openrouter.ai/lab/spawn/sprite/amazonq.sh)

Cline

bash <(curl -fsSL https://openrouter.ai/lab/spawn/sprite/cline.sh)

Non-Interactive Mode

SPRITE_NAME=dev-mk1 \
OPENROUTER_API_KEY=sk-or-v1-xxxxx \
  bash <(curl -fsSL https://openrouter.ai/lab/spawn/sprite/claude.sh)