fix(sandbox): block $HOME/$PWD shell expansions in workspace allowlist - #82
Draft
cursor[bot] wants to merge 2 commits into
Draft
fix(sandbox): block $HOME/$PWD shell expansions in workspace allowlist#82cursor[bot] wants to merge 2 commits into
cursor[bot] wants to merge 2 commits into
Conversation
has_path_chars only flagged tokens starting with / ~ ., so workspace_only skipped cat $HOME/.shellclaw/auth_tokens.json and ANSI-C $'\x2f...' paths. Expand HOME/PWD forms and fail-closed on other $ expansions before the workspace realpath check. Namespaces alone do not chroot the host FS. Co-authored-by: esadrianno <esadrianno@gmail.com>
Double-quoted cat "$HOME/.shellclaw/auth_tokens.json" kept the quotes, so has_path_chars skipped the token. Strip one surrounding quote pair before the expand/workspace check. /bin/sh still expands the inner form. Co-authored-by: esadrianno <esadrianno@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
HIGH workspace escape that survives open PRs #66/#68/#74 allowlist changes:
With
sandbox.enabled+workspace_only,has_path_charsonly flagged tokens starting with/~.. Concrete trigger on main (a057f0e):/bin/shexpands these to absolute paths;sandbox_execonlyunshares +chdirs (no chroot), so the shell tool could read gateway pairing tokens (and other host files) even when the workspace is not colocated with~/.shellclaw(#79).PR #68's embedded
/scanner treats the slash in$HOME/...as a relativesrc/foo-style continuation (prev char is alphanumeric), so it does not catch this. PR #74's relative-token check joinsworkspace/$HOME/..., which does not exist, and leaves the command allowed at the allowlist layer.Fix
In
allowlist_check_shell_command:$...tokens as path-like.$HOME/${HOME}/$PWD/${PWD}(and~) before the workspace check.$'...') and other$/ command-substitution forms underworkspace_only.Test plan
tests/test_allowlist— newtest_workspace_only_blocks_home_env_expansion(HOME/PWD/ANSI-C blocked; bare relativenotes.txtstill allowed)cat $HOME/.shellclaw/auth_tokens.jsonnow returns blocked=1 with expanded path in the reason