mirror of
https://github.com/MervinPraison/PraisonAI.git
synced 2026-11-08 08:11:07 -10:00
* security: Fix Shell Injection Vulnerabilities (CWE-78) - 15 files fixed - Replace shell=True with shell=False across subprocess calls - Add shlex.split() for safe argument parsing - Update async subprocess calls to use create_subprocess_exec - Fix vulnerabilities in core, CLI, tools, examples, and tests - Maintain existing command validation and functionality - Eliminate 29 shell injection attack vectors Security improvements: * Core command execution (execute_command.py) * Safe shell interface (safe_shell.py) * Sandbox execution (sandbox_executor.py) * Workflow and action execution * Memory hooks and documentation tools * Example code and test utilities All functionality preserved while securing against CWE-78 injection attacks. Fixes #1320 🤖 Generated with [Claude Code](https://claude.ai/code) Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com> * fix: move import shlex to module level, fix broken test_command_failure Agent-Logs-Url: https://github.com/MervinPraison/PraisonAI/sessions/7af9d997-bcd4-48a1-b0fe-5c11679ea3a9 Co-authored-by: MervinPraison <[email protected]> * fix: address reviewer feedback - shell API contract, cross-platform shlex, exception handling, env validation - Fix shell=True API contract violation: explicitly reject shell=True with clear error message - Add cross-platform compatibility for shlex.split() using posix=(os.name == 'posix') - Add proper exception handling for malformed command syntax (ValueError from shlex.split) - Add environment variable validation to filter dangerous vars (LD_PRELOAD, PYTHONPATH, etc.) - Update docstring to indicate shell=True is deprecated for security reasons Addresses issues raised by Gemini, Qodo, CodeRabbit, and Copilot reviewers. Co-authored-by: Mervin Praison <[email protected]> --------- Co-authored-by: praisonai-triage-agent[bot] <272766704+praisonai-triage-agent[bot]@users.noreply.github.com> Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: MervinPraison <[email protected]> Co-authored-by: Mervin Praison <[email protected]>
69 lines
2.6 KiB
Python
69 lines
2.6 KiB
Python
from praisonaiagents import Agent, Task, AgentTeam
|
|
import subprocess
|
|
import shlex
|
|
import os
|
|
|
|
def run_terminal_command(command: str):
|
|
"""
|
|
Run a terminal command and return its output.
|
|
"""
|
|
try:
|
|
# Use shell=False with shlex.split for safer execution
|
|
args = shlex.split(command)
|
|
result = subprocess.run(args, shell=False, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
|
|
print(f"Command output: {result}")
|
|
return {"stdout": result.stdout, "stderr": result.stderr}
|
|
except subprocess.CalledProcessError as e:
|
|
return {"error": str(e), "stdout": e.stdout, "stderr": e.stderr}
|
|
|
|
def save_to_file(file_path: str, content: str):
|
|
"""
|
|
Save the given content to the specified file path. Create the folder/file if it doesn't exist.
|
|
"""
|
|
# Ensure the directory exists
|
|
os.makedirs(os.path.dirname(file_path), exist_ok=True)
|
|
|
|
# Write the content to the file
|
|
with open(file_path, 'w') as file:
|
|
file.write(content)
|
|
|
|
return file_path
|
|
|
|
# Create System Operations Agent
|
|
system_ops_agent = Agent(
|
|
name="SystemOps",
|
|
role="System Operations Specialist",
|
|
goal="Execute and manage complex system operations and commands",
|
|
backstory="""You are an expert system administrator with deep knowledge of Unix/Linux systems.
|
|
You excel at running complex system commands, managing processes, and handling system operations.
|
|
You always validate commands before execution and ensure they are safe to run.""",
|
|
reflection=True,
|
|
tools=[run_terminal_command, save_to_file],
|
|
llm="gpt-4o-mini"
|
|
)
|
|
|
|
# Create a complex task that tests various system operations
|
|
task = Task(
|
|
name="system_analysis_task",
|
|
description="""Perform a comprehensive system analysis by executing the following operations in sequence:
|
|
1. Get system information (OS, kernel version)
|
|
2. List 5 running processes and sort them by CPU usage
|
|
3. Check disk space usage and list directories over 1GB
|
|
4. Display current system load and memory usage
|
|
5. List 5 network connections
|
|
6. Create a summary report with all findings in a text file called system_report.txt
|
|
|
|
Do it step by step. One task at a time.
|
|
Save only the Summary report in the file.
|
|
Use appropriate commands for each step and ensure proper error handling.""",
|
|
expected_output="A comprehensive system report containing all requested information saved in system_report.txt",
|
|
agent=system_ops_agent,
|
|
)
|
|
|
|
agents = AgentTeam(
|
|
agents=[system_ops_agent],
|
|
tasks=[task],
|
|
process="sequential"
|
|
)
|
|
|
|
result = agents.start() |