Skip to content

Commit bc28c65

Browse files
ssalbdivadcursoragent
authored and
pullfrog[bot]
committed
harden sandbox escape vectors for bash disabled/restricted modes (#257)
* harden sandbox escape vectors for bash disabled/restricted modes block git config injection (-c flag as subcommand), dangerous subcommands (config, submodule, rebase, bisect), code-executing arg flags (--exec, --extcmd), .gitattributes/.gitmodules writes, and package lifecycle scripts. add retry logic to test runner for transient failures. add security unit tests and adhoc attack tests. Co-authored-by: Cursor <[email protected]> * only filter subcommands in nobash, remove nobash from ui * use regex matching * iterate on tests * simplify githooks --------- Co-authored-by: Cursor <[email protected]>
1 parent f37d02b commit bc28c65

32 files changed

Lines changed: 2509 additions & 1042 deletions

‎.github/workflows/test.yml‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ jobs:
2828
fail-fast: false
2929
matrix:
3030
agent: [claude, codex, cursor, gemini, opencode]
31-
test: [file-read-write, mcpmerge, no-native-file, nobash, restricted, smoke]
31+
test:
32+
[file-read-write, mcpmerge, no-native-file, nobash, restricted, smoke]
3233
env:
3334
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3435
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -56,7 +57,20 @@ jobs:
5657
strategy:
5758
fail-fast: false
5859
matrix:
59-
test: [file-traversal, git-permissions, githooks, proc-sandbox, push-disabled, push-enabled, push-restricted, symlink-traversal, timeout, token-exfil]
60+
test:
61+
[
62+
file-traversal,
63+
git-permissions,
64+
githooks,
65+
pkg-json-scripts,
66+
proc-sandbox,
67+
push-disabled,
68+
push-enabled,
69+
push-restricted,
70+
symlink-traversal,
71+
timeout,
72+
token-exfil,
73+
]
6074
env:
6175
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6276
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

‎agents/codex.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ const FALLBACK_MODEL = "gpt-5.2-codex";
2424

2525
function getCodexEffortConfig(model: string): Record<Effort, CodexEffortConfig> {
2626
return {
27-
mini: { model: "gpt-5.1-codex-mini", reasoningEffort: "low" },
27+
mini: { model: "gpt-5.1-codex", reasoningEffort: "low" },
2828
auto: { model },
2929
max: { model, reasoningEffort: "high" },
3030
};

0 commit comments

Comments
 (0)