Short circuit allow-list check when it includes command chaining characters

This commit is contained in:
John Stearns
2024-11-05 12:42:53 -08:00
parent 0b99347606
commit 920be6d01d
2 changed files with 30 additions and 1 deletions

View File

@@ -134,7 +134,18 @@ export class Cline {
}
protected isAllowedCommand(command?: string): boolean {
if (!command) return false;
if (!command) {
return false;
}
// Check for command chaining characters
if (command.includes('&&') ||
command.includes(';') ||
command.includes('||') ||
command.includes('|') ||
command.includes('$(') ||
command.includes('`')) {
return false;
}
const trimmedCommand = command.trim().toLowerCase();
return ALLOWED_AUTO_EXECUTE_COMMANDS.some(prefix =>
trimmedCommand.startsWith(prefix.toLowerCase())