opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix lint error

Browse source
This commit is contained in:
Badgerbees 2026-04-03 03:25:17 +07:00
parent 09d146cb92
commit ec98564ce6
1 changed files with 26 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
pkg/tools/shell.go
View file

@ -112,10 +112,16 @@ var (
"/dev/stderr": true, "/dev/stderr": true,
} }
scriptPreflightEnvVarPattern = regexp.MustCompile(`\$[A-Z_][A-Z0-9_]{1,}`) scriptPreflightEnvVarPattern = regexp.MustCompile(`\$[A-Z_][A-Z0-9_]{1,}`)
interpreterPipePattern = regexp.MustCompile(`(?i)(?:^|[|;&]\s*)(?:env\s+)?(?:python(?:\d+(?:\.\d+)?)?|node(?:js)?)\b`) interpreterPipePattern = regexp.MustCompile(
interpreterShellWrapperPattern = regexp.MustCompile(`(?i)(?:^|\s)(?:env\s+)?(?:bash|sh|zsh|dash)\b[^\n]*\s-c\s+["']?\s*(?:env\s+)?(?:python(?:\d+(?:\.\d+)?)?|node(?:js)?)\b`) `(?i)(?:^|[|;&]\s*)(?:env\s+)?(?:python(?:\d+(?:\.\d+)?)?|node(?:js)?)\b`,
interpreterProcessSubstPattern = regexp.MustCompile(`(?i)(?:^|\s)(?:env\s+)?(?:python(?:\d+(?:\.\d+)?)?|node(?:js)?)\b[^\n]*<\(`) )
interpreterShellWrapperPattern = regexp.MustCompile(
`(?i)(?:^|\s)(?:env\s+)?(?:bash|sh|zsh|dash)\b[^\n]*\s-c\s+["']?\s*(?:env\s+)?(?:python(?:\d+(?:\.\d+)?)?|node(?:js)?)\b`,
)
interpreterProcessSubstPattern = regexp.MustCompile(
`(?i)(?:^|\s)(?:env\s+)?(?:python(?:\d+(?:\.\d+)?)?|node(?:js)?)\b[^\n]*<\(`,
)
) )
func NewExecTool(workingDir string, restrict bool, allowPaths ...[]*regexp.Regexp) (*ExecTool, error) { func NewExecTool(workingDir string, restrict bool, allowPaths ...[]*regexp.Regexp) (*ExecTool, error) {
@ -1150,7 +1156,10 @@ func (t *ExecTool) validateScriptFileForShellBleed(command, cwd string) string {
} }
if first := scriptPreflightEnvVarPattern.Find(content); len(first) > 0 { if first := scriptPreflightEnvVarPattern.Find(content); len(first) > 0 {
return fmt.Sprintf("Command blocked by safety guard (exec preflight: detected likely shell variable injection (%s))", first) return fmt.Sprintf(
"Command blocked by safety guard (exec preflight: detected likely shell variable injection (%s))",
first,
)
} }
} }
@ -1309,14 +1318,23 @@ func findLastPositionalScriptArg(tokens []string, suffixes []string) string {
if token == "-c" || token == "-m" || token == "-e" || token == "-p" || token == "--eval" || token == "--print" { if token == "-c" || token == "-m" || token == "-e" || token == "-p" || token == "--eval" || token == "--print" {
return "" return ""
} }
if token == "-W" || token == "-X" || token == "-Q" || token == "--check-hash-based-pycs" || token == "-r" || token == "--require" || token == "--import" { if token == "-W" || token == "-X" || token == "-Q" || token == "--check-hash-based-pycs" || token == "-r" ||
token == "--require" ||
token == "--import" {
i++ i++
continue continue
} }
if strings.HasPrefix(token, "-W") || strings.HasPrefix(token, "-X") || strings.HasPrefix(token, "-Q") || strings.HasPrefix(token, "-r") || strings.HasPrefix(token, "-e") || strings.HasPrefix(token, "-p") || strings.HasPrefix(token, "-c") { if strings.HasPrefix(token, "-W") || strings.HasPrefix(token, "-X") || strings.HasPrefix(token, "-Q") ||
strings.HasPrefix(token, "-r") ||
strings.HasPrefix(token, "-e") ||
strings.HasPrefix(token, "-p") ||
strings.HasPrefix(token, "-c") {
continue continue
} }
if strings.HasPrefix(token, "--require=") || strings.HasPrefix(token, "--import=") || strings.HasPrefix(token, "--check-hash-based-pycs=") || strings.HasPrefix(token, "--eval=") || strings.HasPrefix(token, "--print=") { if strings.HasPrefix(token, "--require=") || strings.HasPrefix(token, "--import=") ||
strings.HasPrefix(token, "--check-hash-based-pycs=") ||
strings.HasPrefix(token, "--eval=") ||
strings.HasPrefix(token, "--print=") {
continue continue
} }
if hasScriptSuffix(token, suffixes) { if hasScriptSuffix(token, suffixes) {