fix: mitigate shell injection risk in hooks (#110)#320
fix: mitigate shell injection risk in hooks (#110)#320web3guru888 wants to merge 1 commit intoMemPalace:mainfrom
Conversation
SESSION_ID is extracted from JSON stdin via python3 but then interpolated unquoted into shell commands. A crafted session_id could inject arbitrary shell commands. Sanitize with tr to only allow [a-zA-Z0-9_-] and fall back to 'unknown' if empty after sanitization.
web3guru888
force-pushed
the
fix/shell-injection
branch
from
7ce7674 to
3d8f8a7
Compare
|
Hey — noticed pyproject.toml changes in this PR that widen the chromadb dependency from |
|
@bensig This PR only touches Happy to rebase if needed, but the branch should be clean against current |
|
Closing in favor of #589 — JoeProAI's approach of using the same inline sanitization pattern from Keeping #319 (STAN extension docs) as a separate concern. |
2 participants
fixes #110 by correctly sanitizing the session ID. The python calls already handle their system args, but the SESSION_ID variable required defensive bounds checking to ensure it only captures
a-zA-Z0-9_-rather than unescaped json strings which might interpolate.