Repository navigation
Conversation
- The command validation check used to match bad tokens against the space-joined raw command `lower.contains(bad)`, meaning blocklist evasion could be performed (such as passing `'rm'` instead of `'rm '` which was blocked). - Update `crates/agent/src/tools/workdir_cmd.rs` to validate every single token `part` of the `shell_words_split(cmd)` against blocklist, preventing bypass by shell quoting or omitting padding. - Add an explicit exact match for `rm` since `rm ` and `rm\t` were originally matched. Co-authored-by: bobdivx <6737167+bobdivx@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Closing: false alarm. |
Understood. Acknowledging that this work is now obsolete and stopping work on this task. |
Fix a command injection bypass vulnerability in
validate_commandinsidecrates/agent/src/tools/workdir_cmd.rswhich could allow arbitrary command execution via blocklist evasion using quotation marks or trailing space bypasses (e.g. bypassing"rm "). We now check each token strictly and exactly for"rm". Also added a CRITICAL entry to the security journal.jules/sentinel.md.PR created automatically by Jules for task 3565701423856130564 started by @bobdivx