shumengya/sproutclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(coding-agent): harden git package install paths

Browse Source
This commit is contained in:
Armin Ronacher
2026-06-02 18:20:35 +02:00
parent 0462d44f56
commit a98e087e5d
5 changed files with 109 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
packages/coding-agent/test/git-ssh-url.test.ts
View File

@@ -62,6 +62,19 @@ describe("Git URL Parsing", () => {
});
});
it("should reject unsafe git install path inputs", () => {
for (const source of [
"git:git@evil.example:../../victim/repo",
"https://evil.example/..%2F..%2Fvictim/repo",
"https://evil.example/..%2F..%2Fvictim/repo%",
"git:git@evil.example:/absolute/repo",
"git:git@evil.example:user\\repo/name",
"git:git@evil.example:user/repo\0name",
]) {
expect(parseGitUrl(source)).toBeNull();
}
});
describe("unsupported without git: prefix", () => {
it("should reject git@host:path without git: prefix", () => {
expect(parseGitUrl("git@github.com:user/repo")).toBeNull();