Skip to content

fix: what_changed tool passes shell operators to execFileSync - #231

Open
TerminalGravity wants to merge 1 commit into
mainfrom
fix/what-changed-shell-injection
Open

fix: what_changed tool passes shell operators to execFileSync#231
TerminalGravity wants to merge 1 commit into
mainfrom
fix/what-changed-shell-injection

Conversation

@TerminalGravity

Copy link
Copy Markdown
Collaborator

Bug

what_changed was passing strings with shell operators (2>/dev/null, ||) to run(), which uses execFileSync (no shell). The operators were being split on whitespace and passed as literal git arguments, producing wrong results or errors.

Fix

  • Use array-based run() calls instead of shell command strings
  • Reuse existing getDiffFiles() helper which already handles fallback logic
  • Add proper fallback for git log range queries

Build passes, all 43 tests green.

The run() helper uses execFileSync (no shell), so shell operators
like 2>/dev/null and || were being passed as literal git args,
causing incorrect results. Replace with proper array-based calls
and reuse existing getDiffFiles() helper which already handles
fallback logic.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant