scriptoriumadmin/Roo-Code
1
0
Fork 0
mirror of https://github.com/RooVetGit/Roo-Code.git synced 2026-10-24 05:43:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(security): escape backslashes and cmd metacharacters in hook executor

Browse source 
Backslashes were not escaped before double-quotes in the PowerShell
command wrapper, so paths like C:\foo\" would terminate the string
early and allow injection. cmd /c wrapper had no escaping at all.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
davincidreams 2026-04-27 05:03:04 -04:00
parent 9062273ef5
commit 315e29a2d1
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/core/hooks/executor.ts
View file

@ -71,9 +71,13 @@ async function executeCommandHook(
// Wrap command for different shells
if (shell === "powershell") {
command = `powershell -Command "${command.replace(/"/g, '\\"')}"`
// Escape backslashes first, then double-quotes, to prevent shell injection
const escaped = command.replace(/\\/g, "\\\\").replace(/"/g, '\\"')
command = `powershell -Command "${escaped}"`
} else if (shell === "cmd") {
command = `cmd /c "${command}"`
// Escape % (variable expansion) and ^ (cmd escape char) to prevent injection
const escaped = command.replace(/\^/g, "^^").replace(/%/g, "%%")
command = `cmd /c "${escaped}"`
}
try {