Repository navigation
fix: the sandbox guard reads quotes and heredocs before cutting a command - #101
Merged
Merged
Conversation
…mand
It cut the command on ; | & ( ) { } and newlines with no quote awareness, so
grep -E "error|halt" log, echo "done; reboot now" or a heredoc writing a
line shutdown() were refused as shutting down (hunt toolgate-5 F9). A small
scanner now keeps quoted text and heredoc bodies as data, while $(...) and
backticks are still checked inside double quotes and unquoted heredocs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hunt toolgate-5 F9.
guard()cut the command with a regex on; | & ( ) { }, newlines, backticks and$(, ignoring quotes. Harmless commands were refused with "Refused: shutting down":grep -E "error|halt|panic" log,echo "done; reboot now", or a heredoc that writes a file containingshutdown()._Scanner(toolgate/sandbox/validation.py) now cuts the line the way the shell reads it:$(...)and backticks inside them, which are still separate commands.\escapes the next character.$(...)and backticks are still checked; a quoted delimiter (<<'EOF') makes the whole body data.<<-strips tabs, and<<<is not a heredoc.The per-command checks are unchanged, and
FORK_BOMBandDEVICE_WRITEstill run on the raw text. Known limits are unchanged from main:bash -c "reboot"passes (it did before), and the container stays the boundary.Tests (toolgate/tests/test_sandbox_validation.py,
TestGuardQuotes): 9 commands that must pass (7 of them are refused on main), and 10 that must still be refused, among themecho "$(reboot)", backticks, unquoted heredoc substitution, a command after a heredoc, and"reboot". Local: the validation, runner and guard suites pass (119 passed, 1 skipped). ruff, types and sizes ok.