Skip to content

security: use shellQuote() in agent-setup.ts for consistent null-byte defense#2546

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
louisgv merged 1 commit into from
Mar 12, 2026
Merged

security: use shellQuote() in agent-setup.ts for consistent null-byte defense #2546

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/cli/package.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
{
"name": "@openrouter/spawn",
"version": "0.17.0",
"version": "0.17.1",
"type": "module",
"bin": {
"spawn": "cli.js"
Expand Down
11 changes: 4 additions & 7 deletions packages/cli/src/shared/agent-setup.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -9,7 +9,7 @@ import { join } from "node:path";
import { getTmpDir } from "./paths";
import { asyncTryCatch, asyncTryCatchIf, isOperationalError, tryCatchIf } from "./result.js";
import { getErrorMessage } from "./type-guards";
import { Err, jsonEscape, logError, logInfo, logStep, logWarn, Ok, withRetry } from "./ui";
import { Err, jsonEscape, logError, logInfo, logStep, logWarn, Ok, shellQuote, withRetry } from "./ui";

/**
* Wrap an SSH-based async operation into a Result for use with withRetry.
Expand DownExpand Up@@ -240,8 +240,7 @@ export async function offerGithubAuth(runner: CloudRunner): Promise<void> {

let ghCmd = "curl --proto '=https' -fsSL https://openrouter.ai/labs/spawn/shared/github-auth.sh | bash";
if (githubToken) {
const escaped = githubToken.replace(/'/g, "'\\''");
ghCmd = `export GITHUB_TOKEN='${escaped}' && ${ghCmd}`;
ghCmd = `export GITHUB_TOKEN=${shellQuote(githubToken)} && ${ghCmd}`;
}

logStep("Installing and authenticating GitHub CLI on the remote server...");
Expand All@@ -255,12 +254,10 @@ export async function offerGithubAuth(runner: CloudRunner): Promise<void> {
logStep("Configuring git identity on the remote server...");
const cmds: string[] = [];
if (hostGitName) {
const escaped = hostGitName.replace(/'/g, "'\\''");
cmds.push(`git config --global user.name '${escaped}'`);
cmds.push(`git config --global user.name ${shellQuote(hostGitName)}`);
}
if (hostGitEmail) {
const escaped = hostGitEmail.replace(/'/g, "'\\''");
cmds.push(`git config --global user.email '${escaped}'`);
cmds.push(`git config --global user.email ${shellQuote(hostGitEmail)}`);
}
const gitSetup = await asyncTryCatchIf(isOperationalError, () => runner.runServer(cmds.join(" && ")));
if (gitSetup.ok) {
Expand Down
Loading