5 people 3ac10ab851 fix: broken test and in-function shlex imports from CWE-78 remediation (#1322) ...

* security: Fix Shell Injection Vulnerabilities (CWE-78) - 15 files fixed

- Replace shell=True with shell=False across subprocess calls
- Add shlex.split() for safe argument parsing
- Update async subprocess calls to use create_subprocess_exec
- Fix vulnerabilities in core, CLI, tools, examples, and tests
- Maintain existing command validation and functionality
- Eliminate 29 shell injection attack vectors

Security improvements:
* Core command execution (execute_command.py)
* Safe shell interface (safe_shell.py)
* Sandbox execution (sandbox_executor.py)
* Workflow and action execution
* Memory hooks and documentation tools
* Example code and test utilities

All functionality preserved while securing against CWE-78 injection attacks.

Fixes #1320

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>

* fix: move import shlex to module level, fix broken test_command_failure

Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/7af9d997-bcd4-48a1-b0fe-5c11679ea3a9

Co-authored-by: MervinPraison <[email protected]>

* fix: address reviewer feedback - shell API contract, cross-platform shlex, exception handling, env validation

- Fix shell=True API contract violation: explicitly reject shell=True with clear error message
- Add cross-platform compatibility for shlex.split() using posix=(os.name == 'posix')
- Add proper exception handling for malformed command syntax (ValueError from shlex.split)
- Add environment variable validation to filter dangerous vars (LD_PRELOAD, PYTHONPATH, etc.)
- Update docstring to indicate shell=True is deprecated for security reasons

Addresses issues raised by Gemini, Qodo, CodeRabbit, and Copilot reviewers.

Co-authored-by: Mervin Praison <[email protected]>

---------

Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>

2026-04-09 06:56:55 +01:00

..

app.py

fix: broken test and in-function shlex imports from CWE-78 remediation (#1322)

2026-04-09 06:56:55 +01:00