From 03b6a667c0a3dd313dcba029e0296d1038d30972 Mon Sep 17 00:00:00 2001 From: tuanaiseo Date: Sat, 11 Apr 2026 20:37:27 +0700 Subject: [PATCH] fix(security): potential command injection on windows due to `she (#439) The process is spawned with `shell: process.platform === 'win32'` while including dynamic values (e.g., `opts.sessionId`) in `args`. On Windows, shell invocation can introduce command parsing/injection risks if arguments are not strictly validated/escaped. Affected files: opencodeLocal.ts Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com> --- cli/src/opencode/opencodeLocal.ts | 3 +++ 1 file changed, 3 insertions(+) diff --git a/cli/src/opencode/opencodeLocal.ts b/cli/src/opencode/opencodeLocal.ts index 3b2649a1..fcba1ef2 100644 --- a/cli/src/opencode/opencodeLocal.ts +++ b/cli/src/opencode/opencodeLocal.ts @@ -9,6 +9,9 @@ export async function opencodeLocal(opts: { }): Promise { const args: string[] = []; if (opts.sessionId) { + if (process.platform === 'win32' && /[&|<>^()%!"\r\n]/u.test(opts.sessionId)) { + throw new Error('Invalid sessionId'); + } args.push('--session', opts.sessionId); }