github/deer-flow
1
0
Fork 0
mirror of https://github.com/bytedance/deer-flow.git synced 2026-07-21 21:48:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: allow valid heredoc commands in sandbox audit (#3786)

Browse Source 
* fix: allow valid heredoc sandbox audit commands

* test: cover unparseable heredoc sandbox audit path
This commit is contained in:
Huixin615 2026-06-25 22:43:28 +08:00 committed by GitHub
parent cb3f9ac723
commit b0ce4b513c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
backend/packages/harness/deerflow/agents/middlewares/sandbox_audit_middleware.py
View File

@ -150,8 +150,9 @@ def _classify_single_command(command: str) -> str:
if pattern.search(joined):
return "block"
except ValueError:
# shlex.split fails on unclosed quotes — treat as suspicious
return "block"
# Heredocs and other multiline shell forms may be valid bash but
# unparseable by shlex. Raw high-risk patterns were already checked.
pass
for pattern in _MEDIUM_RISK_PATTERNS:
if pattern.search(normalized):

8
backend/tests/test_sandbox_audit_middleware.py
View File

@ -183,6 +183,14 @@ class TestClassifyCommand:
def test_safe_classified_as_pass(self, cmd):
assert _classify_command(cmd) == "pass", f"Expected 'pass' for: {cmd!r}"
def test_unparseable_heredoc_classified_as_pass(self):
cmd = "python3 << 'EOF'\necho it's fine\nEOF"
assert _classify_command(cmd) == "pass"
def test_unparseable_heredoc_with_high_risk_pattern_still_blocks(self):
cmd = "python3 << 'EOF'\necho it's fine\ncat /etc/shadow\nEOF"
assert _classify_command(cmd) == "block"
# --- Compound commands: sub-command splitting ---
@pytest.mark.parametrize(