shumengya/sproutclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(coding-agent): stop tool argument injection

Browse Source 
closes #4018
This commit is contained in:
Mario Zechner
2026-04-30 21:31:43 +02:00
parent fe66edd943
commit 3d43d2e175
4 changed files with 29 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
packages/coding-agent/src/core/tools/find.ts
View File

@@ -246,7 +246,7 @@ export function createFindToolDefinition(
effectivePattern = `**/${pattern}`;
}
}
args.push(effectivePattern, searchPath);
args.push("--", effectivePattern, searchPath);
const child = spawn(fdPath, args, { stdio: ["ignore", "pipe", "pipe"] });
const rl = createInterface({ input: child.stdout });

2
packages/coding-agent/src/core/tools/grep.ts
View File

@@ -215,7 +215,7 @@ export function createGrepToolDefinition(
if (ignoreCase) args.push("--ignore-case");
if (literal) args.push("--fixed-strings");
if (glob) args.push("--glob", glob);
args.push(pattern, searchPath);
args.push("--", pattern, searchPath);
const child = spawn(rgPath, args, { stdio: ["ignore", "pipe", "pipe"] });
const rl = createInterface({ input: child.stdout });