e6d24369a9
- Block running an explicit LOCAL executable path at command position (./evil, subdir/tool) in both the argv scanner and the shell command scanner: a sandboxed snippet can create + chmod a local script with an interpreter shebang and run it, starting an unguarded child the basename scan never sees. Absolute system-bin paths (/bin, /usr/bin, ...) stay allowed and are still interpreter-checked by basename. - Fail closed on a child file-reader (cat / head / ...) with a relative argv path under a NON-literal subprocess cwd= (cwd=P that could evaluate to /etc), which cannot be proven sandbox-local; a literal benign cwd and a non-reader program stay allowed. - Treat a shell startup variable (BASH_ENV / ENV) in an explicit subprocess env= dict as a shell escape: bash / sh sources it before the -c payload runs. - Runtime backstop: treat the exact /root path (not only /root/*) as sensitive so a directory reader over the root home is denied, and wrap Path.glob / Path.rglob like Path.iterdir so a dynamically built receiver pointing at a sensitive directory is screened. - Make the newline -> ; command-separator rewrite quote-aware, and neutralize quoted separators before the command-boundary regex, so a quoted multiline string (echo "ok\nrm") is not mis-blocked; unquoted separators and command substitution ($(...) / backticks, including inside double quotes) still block. Adds TestRound27Bypasses plus runtime tests for exact /root and pathlib glob / rglob. |
||
|---|---|---|
| .. | ||
| backend | ||
| frontend | ||
| src-tauri | ||
| __init__.py | ||
| install_llama_prebuilt.py | ||
| install_node_prebuilt.py | ||
| install_python_stack.py | ||
| LICENSE.AGPL-3.0 | ||
| node_prebuilt_pins.json | ||
| package-lock.json | ||
| package.json | ||
| setup.bat | ||
| setup.ps1 | ||
| setup.sh | ||
| Unsloth_Studio_Colab.ipynb | ||