fix(sandbox): use Buffer.byteLength for env var value size limit

tzy-17 · tzy-17 · commit e2ac8d56b83e · 2026-07-16T10:37:22.000+08:00
validateEnvVarValue checked value.length (UTF-16 code units) against
the 32768-byte limit, so multi-byte CJK values like "值".repeat(11000)
passed the check despite exceeding 33 KB in UTF-8. Switch to
Buffer.byteLength(value, "utf8") so the limit matches the actual byte
count the OS and child processes see.
diff --git a/src/agents/sandbox/sanitize-env-vars.test.ts b/src/agents/sandbox/sanitize-env-vars.test.ts
@@ -105,4 +105,27 @@ describe("sanitizeEnvVars", () => {
     expect(result.allowed).toEqual({ SAFE_SECRET: "ok" });
     expect(result.blocked).toStrictEqual(["NULL_SECRET"]);
   });
+
+  it("warns on multi-byte values whose UTF-8 byte length exceeds the limit", () => {
+    // Each CJK character is 3 UTF-8 bytes; 11000 chars × 3 bytes = 33000 bytes > 32768.
+    const multiByteValue = "值".repeat(11000);
+    expect(multiByteValue.length).toBe(11000); // UTF-16 length is below 32768
+    expect(Buffer.byteLength(multiByteValue, "utf8")).toBe(33000); // but UTF-8 exceeds limit
+
+    const result = sanitizeEnvVars({ MULTIBYTE: multiByteValue });
+    expect(result.allowed).toEqual({ MULTIBYTE: multiByteValue });
+    expect(result.warnings).toContain("MULTIBYTE: Value exceeds maximum length");
+  });
+
+  it("allows ASCII values at the byte limit boundary", () => {
+    // Use characters outside the base64 charset to avoid triggering the
+    // base64-credential heuristic, which runs before the length check.
+    const atLimit = "a!b!".repeat(8192); // 8192*4 = 32768 bytes, contains !
+    const overLimit = atLimit + "x"; // 32769 bytes
+
+    expect(sanitizeEnvVars({ AT_LIMIT: atLimit }).warnings).toStrictEqual([]);
+    expect(sanitizeEnvVars({ OVER_LIMIT: overLimit }).warnings).toContain(
+      "OVER_LIMIT: Value exceeds maximum length",
+    );
+  });
 });
diff --git a/src/agents/sandbox/sanitize-env-vars.ts b/src/agents/sandbox/sanitize-env-vars.ts
@@ -53,12 +53,14 @@ export type EnvSanitizationOptions = {
   customAllowedPatterns?: ReadonlyArray<RegExp>;
 };
 
+const MAX_ENV_VAR_VALUE_BYTES = 32768;
+
 /** Returns a warning or block reason for environment values that look unsafe to forward. */
 export function validateEnvVarValue(value: string): string | undefined {
   if (value.includes("\0")) {
     return "Contains null bytes";
   }
-  if (value.length > 32768) {
+  if (Buffer.byteLength(value, "utf8") > MAX_ENV_VAR_VALUE_BYTES) {
     return "Value exceeds maximum length";
   }
   if (/^[A-Za-z0-9+/=]{80,}$/.test(value)) {
