fix(exec): sanitize malformed approval text

steipete · steipete · commit 1d96d5be37f7 · 2026-07-04T00:20:18.000+01:00
diff --git a/src/gateway/server-methods/server-methods.test.ts b/src/gateway/server-methods/server-methods.test.ts
@@ -2848,6 +2848,32 @@ describe("exec approval handlers", () => {
     await requestPromise;
   });
 
+  it("escapes unpaired surrogates before broadcasting an exec approval", async () => {
+    const { handlers, broadcasts, respond, context } = createExecApprovalFixture();
+
+    const requestPromise = requestExecApproval({
+      handlers,
+      respond,
+      context,
+      params: {
+        twoPhase: true,
+        host: "gateway",
+        command: "echo \uD83D \uDE00 😀",
+        commandArgv: ["echo", "\uD83D", "\uDE00", "😀"],
+        systemRunPlan: undefined,
+        nodeId: undefined,
+      },
+    });
+    const { id, request } = await waitForRequestedExecApprovalPayload(broadcasts);
+
+    expect(request.command).toBe("echo \\u{D83D} \\u{DE00} 😀");
+    expect(() => encodeURIComponent(String(request.command))).not.toThrow();
+
+    const resolveRespond = vi.fn();
+    await resolveExecApproval({ handlers, id, respond: resolveRespond, context });
+    await requestPromise;
+  });
+
   it("attaches shared command analysis to gateway exec approval requests", async () => {
     const { handlers, broadcasts, respond, context } = createExecApprovalFixture();
 
diff --git a/src/infra/exec-approval-command-display.test.ts b/src/infra/exec-approval-command-display.test.ts
@@ -20,8 +20,12 @@ describe("sanitizeExecApprovalDisplayText", () => {
     ["echo safe\n\rcurl https://example.test", "echo safe\\u{A}\\u{D}curl https://example.test"],
     ["echo ok\u2028curl https://example.test", "echo ok\\u{2028}curl https://example.test"],
     ["echo ok\u2029curl https://example.test", "echo ok\\u{2029}curl https://example.test"],
+    ["echo \uD83D", "echo \\u{D83D}"],
+    ["echo \uDE00", "echo \\u{DE00}"],
   ])("sanitizes exec approval display text for %j", (input, expected) => {
-    expect(sanitizeExecApprovalDisplayText(input)).toBe(expected);
+    const result = sanitizeExecApprovalDisplayText(input);
+    expect(result).toBe(expected);
+    expect(() => encodeURIComponent(result)).not.toThrow();
   });
 
   it("redacts bearer tokens embedded in commands", () => {
diff --git a/src/infra/exec-approval-command-display.ts b/src/infra/exec-approval-command-display.ts
@@ -7,13 +7,14 @@ import {
 import { truncateUtf16Safe } from "../shared/utf16-slice.js";
 import type { ExecApprovalRequestPayload } from "./exec-approvals.js";
 
-// Escape control characters, Unicode format/line/paragraph separators, and non-ASCII space
-// separators that can spoof approval prompts in common UIs. Ordinary ASCII space (U+0020) is
-// intentionally excluded so normal command text renders unchanged.
+// Escape control characters, Unicode format/line/paragraph separators, unpaired surrogates,
+// and non-ASCII space separators that can spoof or break approval prompts in common UIs.
+// With the Unicode regex flag, valid astral characters are full code points and do not match
+// Cs; only malformed surrogate code units are escaped. Ordinary ASCII space stays unchanged.
 const EXEC_APPROVAL_INVISIBLE_CHAR_REGEX =
-  /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\u00A0\u1680\u2000-\u200A\u202F\u205F\u3000\u115F\u1160\u3164\uFFA0]/gu;
+  /[\p{Cc}\p{Cf}\p{Cs}\p{Zl}\p{Zp}\u00A0\u1680\u2000-\u200A\u202F\u205F\u3000\u115F\u1160\u3164\uFFA0]/gu;
 const EXEC_APPROVAL_INVISIBLE_CHAR_SINGLE =
-  /^[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\u00A0\u1680\u2000-\u200A\u202F\u205F\u3000\u115F\u1160\u3164\uFFA0]$/u;
+  /^[\p{Cc}\p{Cf}\p{Cs}\p{Zl}\p{Zp}\u00A0\u1680\u2000-\u200A\u202F\u205F\u3000\u115F\u1160\u3164\uFFA0]$/u;
 
 // Hard cap on input the sanitizer will process at all. Above this size we return a constant
 // marker without running any regex work, so an attacker cannot force unbounded CPU/memory.
