mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-05-20 18:00:23 +00:00
9a98589cef
Add defense-in-depth validation of INPUT_TEST_TIMEOUT directly in verify.sh (not just relying on common.sh). Each input test function now calls _validate_timeout() to ensure the value contains only digits before use. Additionally, instead of interpolating INPUT_TEST_TIMEOUT directly into remote command strings passed to cloud_exec, the timeout value is now assigned to a single-quoted remote variable (_TIMEOUT) and referenced via "$_TIMEOUT" on the remote side. This eliminates the injection surface even if validation were somehow bypassed. Affected functions: input_test_claude(), input_test_codex(), input_test_openclaw(), input_test_zeroclaw(). Fixes #2849 Agent: security-auditor Co-authored-by: B <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| aws | ||
| cli | ||
| digitalocean | ||
| docker | ||
| e2e | ||
| gcp | ||
| hetzner | ||
| local | ||
| shared | ||
| sprite | ||
| test | ||