fix: reject shell expansion in safe-bin tokens

pgondhi987 · pgondhi987 · commit 24fb806d7390 · 2026-05-12T11:11:31.000Z
diff --git a/src/infra/exec-approvals-safe-bins.test.ts b/src/infra/exec-approvals-safe-bins.test.ts
@@ -223,6 +223,30 @@ describe("exec approvals safe bins", () => {
       expected: false,
       setup: (cwd) => fs.writeFileSync(path.join(cwd, "secret.json"), "{}"),
     },
+    {
+      name: "blocks POSIX parameter expansion in safe-bin value tokens",
+      argv: ["head", "-c${IFS}16${IFS}${OPENCLAW_CONFIG_PATH}"],
+      resolvedPath: "/usr/bin/head",
+      expected: false,
+      safeBins: ["head"],
+      executableName: "head",
+    },
+    {
+      name: "blocks POSIX parameter expansion in safe-bin long option values",
+      argv: ["head", "--bytes=${IFS}16"],
+      resolvedPath: "/usr/bin/head",
+      expected: false,
+      safeBins: ["head"],
+      executableName: "head",
+    },
+    {
+      name: "blocks POSIX parameter expansion in safe-bin positional tokens",
+      argv: ["tr", "${IFS}", "_"],
+      resolvedPath: "/usr/bin/tr",
+      expected: false,
+      safeBins: ["tr"],
+      executableName: "tr",
+    },
     {
       name: "blocks safe bins resolved from untrusted directories",
       argv: ["jq", ".foo"],
diff --git a/src/infra/exec-safe-bin-policy-validator.ts b/src/infra/exec-safe-bin-policy-validator.ts
@@ -29,13 +29,17 @@ function hasGlobToken(value: string): boolean {
   return /[*?[\]]/.test(value);
 }
 
+function hasShellExpansionToken(value: string): boolean {
+  return /\$(?:[A-Za-z0-9_@*?!$#-]|\{|\(|\[)/.test(value);
+}
+
 const NO_FLAGS: ReadonlySet<string> = new Set();
 
 function isSafeLiteralToken(value: string): boolean {
   if (!value || value === "-") {
     return true;
   }
-  return !hasGlobToken(value) && !isPathLikeToken(value);
+  return !hasGlobToken(value) && !hasShellExpansionToken(value) && !isPathLikeToken(value);
 }
 
 function isInvalidValueToken(value: string | undefined): boolean {
diff --git a/src/node-host/invoke-system-run.test.ts b/src/node-host/invoke-system-run.test.ts
@@ -750,6 +750,21 @@ describe("handleSystemRunInvoke mac app exec host routing", () => {
     }
   });
 
+  it.runIf(process.platform !== "win32")(
+    "denies safe-bin shell expansion carriers in allowlist mode",
+    async () => {
+      const { runCommand, sendInvokeResult } = await runSystemInvoke({
+        preferMacAppExecHost: false,
+        security: "allowlist",
+        ask: "off",
+        command: ["/bin/sh", "-lc", "head -c${IFS}16${IFS}${OPENCLAW_CONFIG_PATH}"],
+      });
+
+      expect(runCommand).not.toHaveBeenCalled();
+      expectInvokeErrorMessage(sendInvokeResult, { message: "allowlist miss" });
+    },
+  );
+
   it("denies abbreviated PowerShell encoded payloads even when the wrapper is allowlisted", async () => {
     const binDir = createFixtureDir("openclaw-pwsh-allowlist-");
     const executablePath = createTempExecutable({ dir: binDir, name: "pwsh" });

Original file line number	Diff line number	Diff line change
`@@ -29,13 +29,17 @@ function hasGlobToken(value: string): boolean {`
`29`	`29`	`return /[*?[\]]/.test(value);`
`30`	`30`	`}`
`31`	`31`
	`32`	`+function hasShellExpansionToken(value: string): boolean {`
	`33`	`+ return /\$(?:[A-Za-z0-9_@*?!$#-]\|\{\|\(\|\[)/.test(value);`
	`34`	`+}`
	`35`	`+`
`32`	`36`	`const NO_FLAGS: ReadonlySet<string> = new Set();`
`33`	`37`
`34`	`38`	`function isSafeLiteralToken(value: string): boolean {`
`35`	`39`	`if (!value \|\| value === "-") {`
`36`	`40`	`return true;`
`37`	`41`	`}`
`38`		`- return !hasGlobToken(value) && !isPathLikeToken(value);`
	`42`	`+ return !hasGlobToken(value) && !hasShellExpansionToken(value) && !isPathLikeToken(value);`
`39`	`43`	`}`
`40`	`44`
`41`	`45`	`function isInvalidValueToken(value: string \| undefined): boolean {`