sec (5/9): reject unsafe targets on the Windows host shell#29
Open
jesse-merhi wants to merge 1 commit into
Open
sec (5/9): reject unsafe targets on the Windows host shell#29jesse-merhi wants to merge 1 commit into
jesse-merhi wants to merge 1 commit into
Conversation
cmd.exe expands %VAR% even inside double quotes, expands !VAR! under delayed expansion, and does not treat backslash as an escape for ". A target path containing %, !, or \" could therefore break out of its quoted argument and inject host commands. Reject such targets on the Windows host shell before building the command line. The Docker sandbox (a POSIX shell in the container) is unaffected.
This was referenced Jul 23, 2026
|
ClawSweeper status: review started. I am starting a fresh review of this pull request: sec (5/9): reject unsafe targets on the Windows host shell This is item 1/1 in the current shard. Shard 0/1. This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking. Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes
On the Windows host shell (
--sandbox offon Windows), a user-definedscanner target containing
%,", or!is now rejected instead of beinginterpolated into the
cmd.execommand line.Why it matters
cmd.exeexpands%VAR%even inside double quotes, expands!VAR!when delayedexpansion is on, and does not let backslash escape a
". So a target pathcontaining those characters could break out of the intended argument and inject
host commands. Since a target name/path can come from untrusted skill content,
that is a command-injection vector on Windows. Rejecting those characters closes
it. This affects only the Windows host shell path — the Docker sandbox (the
default) and POSIX hosts pass the target as a positional
"$1"argument and areunaffected.
Before / after
skill%PATH%.mdcmd.exeline — expansion/injection riskfailed, no command runplain-skill.mdThe guard is
unsafeWindowsShellTarget(target); it fires only when the resolvedshell is the Windows host shell, so Docker/POSIX behavior is untouched.
Verify
TestUnsafeWindowsShellTargetDetectsInjectionCharacterscovers%,",!(rejected) and safe targets (allowed). Cross-compiles clean:
GOOS=windows go build ./....