mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: reject shell strings in trans argv

Browse Source
This commit is contained in:
Codex
2026-06-03 07:05:53 +00:00
parent e806218184
commit 4dd75fff29
3 changed files with 33 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/src/ssh.ts
+19 -1
View File
@@ -870,6 +870,7 @@ export function parseSshArgs(args: string[]): ParsedSshArgs {
if (subcommand === "argv" || subcommand === "exec") {
const toolArgs = args.slice(1);
if (toolArgs.length === 0) throw new Error(`ssh ${subcommand} requires a command`);
validateDirectArgvCommand(subcommand, toolArgs);
return { remoteCommand: shellArgv(toolArgs), requiresStdin: false, invocationKind: "argv" };
}
if (subcommand === "find") {
@@ -910,6 +911,20 @@ export function parseSshArgs(args: string[]): ParsedSshArgs {
};
}
function validateDirectArgvCommand(commandName: string, toolArgs: string[]): void {
if (toolArgs.length !== 1) return;
const command = toolArgs[0] ?? "";
if (!looksLikeShellCommandString(command)) return;
throw new Error(
`ssh ${commandName} received one shell-like command string; ${commandName} executes a single process and treats that string as the executable path. ` +
`Use \`trans <route> script -- ${shellQuote(command)}\` for one-line shell logic, or split argv tokens, for example \`trans <route> ${commandName} ls -la\`.`
);
}
function looksLikeShellCommandString(value: string): boolean {
return /\s/u.test(value) || /&&|\|\||[;|<>]/u.test(value);
}
export function parseSshInvocation(target: string, args: string[]): ParsedSshInvocation {
const route = parseSshRoute(target);
if (route.plane === "k3s") {
@@ -1401,7 +1416,10 @@ function parseK3sTargetOperation(route: ParsedSshRoute, args: string[]): ParsedS
return { remoteCommand: buildK3sExecCommand([...targetArgs, "--", parsed.shell, "-c", shellScriptWithCompatibility(parsed.command)]), requiresStdin: false, invocationKind: "helper" };
}
if (operation === "logs") return { remoteCommand: buildK3sLogsCommand([...targetArgs, ...operationArgs]), requiresStdin: false, invocationKind: "helper" };
if (operation === "argv") return { remoteCommand: buildK3sExecCommand([...targetArgs, ...k3sRouteCommandArgs(operationArgs)]), requiresStdin: false, invocationKind: "argv" };
if (operation === "argv") {
validateDirectArgvCommand(operation, operationArgs);
return { remoteCommand: buildK3sExecCommand([...targetArgs, ...k3sRouteCommandArgs(operationArgs)]), requiresStdin: false, invocationKind: "argv" };
}
if (operation === "get" || operation === "describe") {
return { remoteCommand: buildK3sTargetObjectCommand(operation, route, operationArgs), requiresStdin: false, invocationKind: "helper" };
}