fix: validate provider name in invalidate_cloud_key and improve key validation by la14-1 · Pull Request #1017 · OpenRouterLabs/spawn

la14-1 · 2026-02-13T22:34:38Z

Summary

Path traversal fix (shared/key-request.sh:202-211): invalidate_cloud_key() now validates the provider parameter against ^[a-z0-9][a-z0-9._-]{0,63}$ before constructing a file path, preventing path traversal attacks that could delete arbitrary files (e.g., ../../etc/passwd). This matches the same SAFE_PROVIDER_RE regex already used in key-server.ts.
Key validation hardening (.claude/skills/setup-agent-team/key-server.ts:303): validKeyVal() now blocks control characters (U+0000-U+001F, U+007F-U+009F) and enforces a 4096-byte max length. Previously it only blocked shell metacharacters, allowing null bytes, newlines, and arbitrarily long values through.

Test plan

bash -n shared/key-request.sh passes
bun test passes (7654 pass, 185 pre-existing failures unrelated to these changes)
Verify invalidate_cloud_key "../../../tmp/test" returns 1 and logs error
Verify validKeyVal("key-with-\x00-null") returns false
Verify validKeyVal("") returns false (empty)
Verify validKeyVal("sk-valid-key-12345") returns true

-- refactor/security-auditor

…alidation - Add regex validation (^[a-z0-9][a-z0-9._-]{0,63}$) to invalidate_cloud_key() in shared/key-request.sh to prevent path traversal attacks that could delete arbitrary files via crafted provider names (e.g., ../../etc/important) - Improve validKeyVal() in key-server.ts to block control characters (U+0000-U+001F, U+007F-U+009F) and enforce a 4096-byte max length on API key values, preventing injection of null bytes, newlines, and excessively long values Agent: security-auditor Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This PR is a security improvement:

shared/key-request.sh:205-210 — Adds path traversal prevention in invalidate_cloud_key(). Provider name validated against ^[a-z0-9][a-z0-9._-]{0,63}$, preventing ../ directory escape. Clean and correct.
.claude/skills/setup-agent-team/key-server.ts:304-308 — Strengthens validKeyVal() with length bounds (0-4096) and control character blocking (\x00-\x1f, \x7f-\x9f). Good defense-in-depth.

Tests

bash -n: PASS (shared/key-request.sh)
bun test: PASS (7655 pass, 184 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatibilities introduced)

-- security/pr-reviewer

la14-1 · 2026-02-13T22:34:38Z

Summary

Path traversal fix (shared/key-request.sh:202-211): invalidate_cloud_key() now validates the provider parameter against ^[a-z0-9][a-z0-9._-]{0,63}$ before constructing a file path, preventing path traversal attacks that could delete arbitrary files (e.g., ../../etc/passwd). This matches the same SAFE_PROVIDER_RE regex already used in key-server.ts.
Key validation hardening (.claude/skills/setup-agent-team/key-server.ts:303): validKeyVal() now blocks control characters (U+0000-U+001F, U+007F-U+009F) and enforces a 4096-byte max length. Previously it only blocked shell metacharacters, allowing null bytes, newlines, and arbitrarily long values through.

Fixes#1013

Test plan

bash -n shared/key-request.sh passes
bun test passes (7654 pass, 185 pre-existing failures unrelated to these changes)
Verify invalidate_cloud_key "../../../tmp/test" returns 1 and logs error
Verify validKeyVal("key-with-\x00-null") returns false
Verify validKeyVal("") returns false (empty)
Verify validKeyVal("sk-valid-key-12345") returns true

-- refactor/security-auditor

…alidation - Add regex validation (^[a-z0-9][a-z0-9._-]{0,63}$) to invalidate_cloud_key() in shared/key-request.sh to prevent path traversal attacks that could delete arbitrary files via crafted provider names (e.g., ../../etc/important) - Improve validKeyVal() in key-server.ts to block control characters (U+0000-U+001F, U+007F-U+009F) and enforce a 4096-byte max length on API key values, preventing injection of null bytes, newlines, and excessively long values Agent: security-auditor Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This PR is a security improvement:

shared/key-request.sh:205-210 — Adds path traversal prevention in invalidate_cloud_key(). Provider name validated against ^[a-z0-9][a-z0-9._-]{0,63}$, preventing ../ directory escape. Clean and correct.
.claude/skills/setup-agent-team/key-server.ts:304-308 — Strengthens validKeyVal() with length bounds (0-4096) and control character blocking (\x00-\x1f, \x7f-\x9f). Good defense-in-depth.

Tests

bash -n: PASS (shared/key-request.sh)
bun test: PASS (7655 pass, 184 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatibilities introduced)

-- security/pr-reviewer

la14-1 · 2026-02-13T22:34:38Z

Summary

Path traversal fix (shared/key-request.sh:202-211): invalidate_cloud_key() now validates the provider parameter against ^[a-z0-9][a-z0-9._-]{0,63}$ before constructing a file path, preventing path traversal attacks that could delete arbitrary files (e.g., ../../etc/passwd). This matches the same SAFE_PROVIDER_RE regex already used in key-server.ts.
Key validation hardening (.claude/skills/setup-agent-team/key-server.ts:303): validKeyVal() now blocks control characters (U+0000-U+001F, U+007F-U+009F) and enforces a 4096-byte max length. Previously it only blocked shell metacharacters, allowing null bytes, newlines, and arbitrarily long values through.

Fixes#1013

Test plan

bash -n shared/key-request.sh passes
bun test passes (7654 pass, 185 pre-existing failures unrelated to these changes)
Verify invalidate_cloud_key "../../../tmp/test" returns 1 and logs error
Verify validKeyVal("key-with-\x00-null") returns false
Verify validKeyVal("") returns false (empty)
Verify validKeyVal("sk-valid-key-12345") returns true

-- refactor/security-auditor

…alidation - Add regex validation (^[a-z0-9][a-z0-9._-]{0,63}$) to invalidate_cloud_key() in shared/key-request.sh to prevent path traversal attacks that could delete arbitrary files via crafted provider names (e.g., ../../etc/important) - Improve validKeyVal() in key-server.ts to block control characters (U+0000-U+001F, U+007F-U+009F) and enforce a 4096-byte max length on API key values, preventing injection of null bytes, newlines, and excessively long values Agent: security-auditor Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This PR is a security improvement:

shared/key-request.sh:205-210 — Adds path traversal prevention in invalidate_cloud_key(). Provider name validated against ^[a-z0-9][a-z0-9._-]{0,63}$, preventing ../ directory escape. Clean and correct.
.claude/skills/setup-agent-team/key-server.ts:304-308 — Strengthens validKeyVal() with length bounds (0-4096) and control character blocking (\x00-\x1f, \x7f-\x9f). Good defense-in-depth.

Tests

bash -n: PASS (shared/key-request.sh)
bun test: PASS (7655 pass, 184 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatibilities introduced)

-- security/pr-reviewer

la14-1 · 2026-02-13T22:34:38Z

Summary

Path traversal fix (shared/key-request.sh:202-211): invalidate_cloud_key() now validates the provider parameter against ^[a-z0-9][a-z0-9._-]{0,63}$ before constructing a file path, preventing path traversal attacks that could delete arbitrary files (e.g., ../../etc/passwd). This matches the same SAFE_PROVIDER_RE regex already used in key-server.ts.
Key validation hardening (.claude/skills/setup-agent-team/key-server.ts:303): validKeyVal() now blocks control characters (U+0000-U+001F, U+007F-U+009F) and enforces a 4096-byte max length. Previously it only blocked shell metacharacters, allowing null bytes, newlines, and arbitrarily long values through.

Fixes#1013

Test plan

bash -n shared/key-request.sh passes
bun test passes (7654 pass, 185 pre-existing failures unrelated to these changes)
Verify invalidate_cloud_key "../../../tmp/test" returns 1 and logs error
Verify validKeyVal("key-with-\x00-null") returns false
Verify validKeyVal("") returns false (empty)
Verify validKeyVal("sk-valid-key-12345") returns true

-- refactor/security-auditor

…alidation - Add regex validation (^[a-z0-9][a-z0-9._-]{0,63}$) to invalidate_cloud_key() in shared/key-request.sh to prevent path traversal attacks that could delete arbitrary files via crafted provider names (e.g., ../../etc/important) - Improve validKeyVal() in key-server.ts to block control characters (U+0000-U+001F, U+007F-U+009F) and enforce a 4096-byte max length on API key values, preventing injection of null bytes, newlines, and excessively long values Agent: security-auditor Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This PR is a security improvement:

shared/key-request.sh:205-210 — Adds path traversal prevention in invalidate_cloud_key(). Provider name validated against ^[a-z0-9][a-z0-9._-]{0,63}$, preventing ../ directory escape. Clean and correct.
.claude/skills/setup-agent-team/key-server.ts:304-308 — Strengthens validKeyVal() with length bounds (0-4096) and control character blocking (\x00-\x1f, \x7f-\x9f). Good defense-in-depth.

Tests

bash -n: PASS (shared/key-request.sh)
bun test: PASS (7655 pass, 184 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatibilities introduced)

-- security/pr-reviewer

la14-1 · 2026-02-13T22:34:38Z

Summary

Path traversal fix (shared/key-request.sh:202-211): invalidate_cloud_key() now validates the provider parameter against ^[a-z0-9][a-z0-9._-]{0,63}$ before constructing a file path, preventing path traversal attacks that could delete arbitrary files (e.g., ../../etc/passwd). This matches the same SAFE_PROVIDER_RE regex already used in key-server.ts.
Key validation hardening (.claude/skills/setup-agent-team/key-server.ts:303): validKeyVal() now blocks control characters (U+0000-U+001F, U+007F-U+009F) and enforces a 4096-byte max length. Previously it only blocked shell metacharacters, allowing null bytes, newlines, and arbitrarily long values through.

Fixes#1013

Test plan

bash -n shared/key-request.sh passes
bun test passes (7654 pass, 185 pre-existing failures unrelated to these changes)
Verify invalidate_cloud_key "../../../tmp/test" returns 1 and logs error
Verify validKeyVal("key-with-\x00-null") returns false
Verify validKeyVal("") returns false (empty)
Verify validKeyVal("sk-valid-key-12345") returns true

-- refactor/security-auditor

…alidation - Add regex validation (^[a-z0-9][a-z0-9._-]{0,63}$) to invalidate_cloud_key() in shared/key-request.sh to prevent path traversal attacks that could delete arbitrary files via crafted provider names (e.g., ../../etc/important) - Improve validKeyVal() in key-server.ts to block control characters (U+0000-U+001F, U+007F-U+009F) and enforce a 4096-byte max length on API key values, preventing injection of null bytes, newlines, and excessively long values Agent: security-auditor Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This PR is a security improvement:

shared/key-request.sh:205-210 — Adds path traversal prevention in invalidate_cloud_key(). Provider name validated against ^[a-z0-9][a-z0-9._-]{0,63}$, preventing ../ directory escape. Clean and correct.
.claude/skills/setup-agent-team/key-server.ts:304-308 — Strengthens validKeyVal() with length bounds (0-4096) and control character blocking (\x00-\x1f, \x7f-\x9f). Good defense-in-depth.

Tests

bash -n: PASS (shared/key-request.sh)
bun test: PASS (7655 pass, 184 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatibilities introduced)

-- security/pr-reviewer

la14-1 · 2026-02-13T22:34:38Z

Summary

Path traversal fix (shared/key-request.sh:202-211): invalidate_cloud_key() now validates the provider parameter against ^[a-z0-9][a-z0-9._-]{0,63}$ before constructing a file path, preventing path traversal attacks that could delete arbitrary files (e.g., ../../etc/passwd). This matches the same SAFE_PROVIDER_RE regex already used in key-server.ts.
Key validation hardening (.claude/skills/setup-agent-team/key-server.ts:303): validKeyVal() now blocks control characters (U+0000-U+001F, U+007F-U+009F) and enforces a 4096-byte max length. Previously it only blocked shell metacharacters, allowing null bytes, newlines, and arbitrarily long values through.

Fixes#1013

Test plan

bash -n shared/key-request.sh passes
bun test passes (7654 pass, 185 pre-existing failures unrelated to these changes)
Verify invalidate_cloud_key "../../../tmp/test" returns 1 and logs error
Verify validKeyVal("key-with-\x00-null") returns false
Verify validKeyVal("") returns false (empty)
Verify validKeyVal("sk-valid-key-12345") returns true

-- refactor/security-auditor

…alidation - Add regex validation (^[a-z0-9][a-z0-9._-]{0,63}$) to invalidate_cloud_key() in shared/key-request.sh to prevent path traversal attacks that could delete arbitrary files via crafted provider names (e.g., ../../etc/important) - Improve validKeyVal() in key-server.ts to block control characters (U+0000-U+001F, U+007F-U+009F) and enforce a 4096-byte max length on API key values, preventing injection of null bytes, newlines, and excessively long values Agent: security-auditor Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This PR is a security improvement:

shared/key-request.sh:205-210 — Adds path traversal prevention in invalidate_cloud_key(). Provider name validated against ^[a-z0-9][a-z0-9._-]{0,63}$, preventing ../ directory escape. Clean and correct.
.claude/skills/setup-agent-team/key-server.ts:304-308 — Strengthens validKeyVal() with length bounds (0-4096) and control character blocking (\x00-\x1f, \x7f-\x9f). Good defense-in-depth.

Tests

bash -n: PASS (shared/key-request.sh)
bun test: PASS (7655 pass, 184 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatibilities introduced)

-- security/pr-reviewer

la14-1 · 2026-02-13T22:34:38Z

Summary

Path traversal fix (shared/key-request.sh:202-211): invalidate_cloud_key() now validates the provider parameter against ^[a-z0-9][a-z0-9._-]{0,63}$ before constructing a file path, preventing path traversal attacks that could delete arbitrary files (e.g., ../../etc/passwd). This matches the same SAFE_PROVIDER_RE regex already used in key-server.ts.
Key validation hardening (.claude/skills/setup-agent-team/key-server.ts:303): validKeyVal() now blocks control characters (U+0000-U+001F, U+007F-U+009F) and enforces a 4096-byte max length. Previously it only blocked shell metacharacters, allowing null bytes, newlines, and arbitrarily long values through.

Fixes#1013

Test plan

bash -n shared/key-request.sh passes
bun test passes (7654 pass, 185 pre-existing failures unrelated to these changes)
Verify invalidate_cloud_key "../../../tmp/test" returns 1 and logs error
Verify validKeyVal("key-with-\x00-null") returns false
Verify validKeyVal("") returns false (empty)
Verify validKeyVal("sk-valid-key-12345") returns true

-- refactor/security-auditor

…alidation - Add regex validation (^[a-z0-9][a-z0-9._-]{0,63}$) to invalidate_cloud_key() in shared/key-request.sh to prevent path traversal attacks that could delete arbitrary files via crafted provider names (e.g., ../../etc/important) - Improve validKeyVal() in key-server.ts to block control characters (U+0000-U+001F, U+007F-U+009F) and enforce a 4096-byte max length on API key values, preventing injection of null bytes, newlines, and excessively long values Agent: security-auditor Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This PR is a security improvement:

shared/key-request.sh:205-210 — Adds path traversal prevention in invalidate_cloud_key(). Provider name validated against ^[a-z0-9][a-z0-9._-]{0,63}$, preventing ../ directory escape. Clean and correct.
.claude/skills/setup-agent-team/key-server.ts:304-308 — Strengthens validKeyVal() with length bounds (0-4096) and control character blocking (\x00-\x1f, \x7f-\x9f). Good defense-in-depth.

Tests

bash -n: PASS (shared/key-request.sh)
bun test: PASS (7655 pass, 184 pre-existing failures unrelated to this PR)
curl|bash pattern: OK (no changes to source/eval fallback)
macOS compat: OK (no bash 3.x incompatibilities introduced)

-- security/pr-reviewer

la14-1 · 2026-02-13T22:34:38Z

Summary

Path traversal fix (shared/key-request.sh:202-211): invalidate_cloud_key() now validates the provider parameter against ^[a-z0-9][a-z0-9._-]{0,63}$ before constructing a file path, preventing path traversal attacks that could delete arbitrary files (e.g., ../../etc/passwd). This matches the same SAFE_PROVIDER_RE regex already used in key-server.ts.
Key validation hardening (.claude/skills/setup-agent-team/key-server.ts:303): validKeyVal() now blocks control characters (U+0000-U+001F, U+007F-U+009F) and enforces a 4096-byte max length. Previously it only blocked shell metacharacters, allowing null bytes, newlines, and arbitrarily long values through.

Fixes#1013

Test plan

bash -n shared/key-request.sh passes
bun test passes (7654 pass, 185 pre-existing failures unrelated to these changes)
Verify invalidate_cloud_key "../../../tmp/test" returns 1 and logs error
Verify validKeyVal("key-with-\x00-null") returns false
Verify validKeyVal("") returns false (empty)
Verify validKeyVal("sk-valid-key-12345") returns true

-- refactor/security-auditor

…alidation - Add regex validation (^[a-z0-9][a-z0-9._-]{0,63}$) to invalidate_cloud_key() in shared/key-request.sh to prevent path traversal attacks that could delete arbitrary files via crafted provider names (e.g., ../../etc/important) - Improve validKeyVal() in key-server.ts to block control characters (U+0000-U+001F, U+007F-U+009F) and enforce a 4096-byte max length on API key values, preventing injection of null bytes, newlines, and excessively long values Agent: security-auditor Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This PR is a security improvement:

shared/key-request.sh:205-210 — Adds path traversal prevention in invalidate_cloud_key(). Provider name validated against ^[a-z0-9][a-z0-9._-]{0,63}$, preventing ../ directory escape. Clean and correct.
.claude/skills/setup-agent-team/key-server.ts:304-308 — Strengthens validKeyVal() with length bounds (0-4096) and control character blocking (\x00-\x1f, \x7f-\x9f). Good defense-in-depth.