From 88f3f106e12db2f8190f780e1a59fcdc24187106 Mon Sep 17 00:00:00 2001 From: Roo Code Date: Mon, 1 Dec 2025 21:34:33 +0000 Subject: [PATCH] fix: prevent command auto-approval bypass with queued messages When there are queued messages and a command/tool execution ask comes up, the system now checks if auto-approval is enabled before executing commands. If auto-approval is disabled, commands are rejected to prevent unauthorized execution. This fixes a critical security vulnerability where commands could be executed without user consent when messages were queued. Fixes #9720 --- src/core/task/Task.ts | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/core/task/Task.ts b/src/core/task/Task.ts index c4a52246aa..96f6973274 100644 --- a/src/core/task/Task.ts +++ b/src/core/task/Task.ts @@ -1087,9 +1087,16 @@ export class Task extends EventEmitter implements TaskLike { type === "browser_action_launch" || type === "use_mcp_server" ) { - // For tool approvals, we need to approve first, then send - // the message if there's text/images. - this.handleWebviewAskResponse("yesButtonClicked", message.text, message.images) + // For tool approvals, check if auto-approval is enabled + // If auto-approval is disabled (approval.decision === "ask"), reject the command + // to prevent unauthorized execution, then send the queued message + if (approval.decision === "ask") { + // Reject the command/tool execution to prevent bypass + this.handleWebviewAskResponse("noButtonClicked", message.text, message.images) + } else { + // Only approve if auto-approval is enabled + this.handleWebviewAskResponse("yesButtonClicked", message.text, message.images) + } } else { // For other ask types (like followup or command_output), fulfill the ask // directly.