From b0ce4b513c5d83b40036eaeb1a1d2f6bb63b4f6f Mon Sep 17 00:00:00 2001 From: Huixin615 Date: Thu, 25 Jun 2026 22:43:28 +0800 Subject: [PATCH] fix: allow valid heredoc commands in sandbox audit (#3786) * fix: allow valid heredoc sandbox audit commands * test: cover unparseable heredoc sandbox audit path --- .../agents/middlewares/sandbox_audit_middleware.py | 5 +++-- backend/tests/test_sandbox_audit_middleware.py | 8 ++++++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/backend/packages/harness/deerflow/agents/middlewares/sandbox_audit_middleware.py b/backend/packages/harness/deerflow/agents/middlewares/sandbox_audit_middleware.py index ad7d02357..3b2cd85f3 100644 --- a/backend/packages/harness/deerflow/agents/middlewares/sandbox_audit_middleware.py +++ b/backend/packages/harness/deerflow/agents/middlewares/sandbox_audit_middleware.py @@ -150,8 +150,9 @@ def _classify_single_command(command: str) -> str: if pattern.search(joined): return "block" except ValueError: - # shlex.split fails on unclosed quotes — treat as suspicious - return "block" + # Heredocs and other multiline shell forms may be valid bash but + # unparseable by shlex. Raw high-risk patterns were already checked. + pass for pattern in _MEDIUM_RISK_PATTERNS: if pattern.search(normalized): diff --git a/backend/tests/test_sandbox_audit_middleware.py b/backend/tests/test_sandbox_audit_middleware.py index 49ce17219..97055f213 100644 --- a/backend/tests/test_sandbox_audit_middleware.py +++ b/backend/tests/test_sandbox_audit_middleware.py @@ -183,6 +183,14 @@ class TestClassifyCommand: def test_safe_classified_as_pass(self, cmd): assert _classify_command(cmd) == "pass", f"Expected 'pass' for: {cmd!r}" + def test_unparseable_heredoc_classified_as_pass(self): + cmd = "python3 << 'EOF'\necho it's fine\nEOF" + assert _classify_command(cmd) == "pass" + + def test_unparseable_heredoc_with_high_risk_pattern_still_blocks(self): + cmd = "python3 << 'EOF'\necho it's fine\ncat /etc/shadow\nEOF" + assert _classify_command(cmd) == "block" + # --- Compound commands: sub-command splitting --- @pytest.mark.parametrize(