Repository navigation
Escape backslashes in quoteShellArg so pasted hints cannot run commands - #450
Merged
Merged
Conversation
Inside POSIX double quotes a backslash is itself special, so a server-chosen value like `\$(id)` was rendered as `"\\$(id)"`: a literal backslash followed by a live command substitution. A trailing backslash likewise escaped the closing quote. Backslashes are now escaped on POSIX (Windows keeps them as path separators), with a unit test that round-trips hostile values through a real shell. Fixes GHSA-wmqm-r8wm-9f34 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WMAPaE5empDFSAWVKwxmPE
jancurn
changed the title
There was a problem hiding this comment.
🟢 Approval recommended
The narrow fix addresses the reported injection vectors with targeted regression coverage and no identified blocking issues.
0 open findings
What changed in this PR
Fixes POSIX shell injection in mcpc’s copy-paste hints by escaping backslashes in quoted arguments.
Changes:
- Escapes POSIX backslashes while preserving Windows behavior.
- Adds hostile-input regression tests, including real-shell round trips.
- Documents the security fix.
| File | Description |
|---|---|
test/unit/cli/output.test.ts |
Tests escaping and literal argument preservation. |
src/cli/output.ts |
Escapes backslashes inside POSIX double quotes. |
CHANGELOG.md |
Records the security fix and advisory. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
4 of 5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
quoteShellArgdouble-quoted server-chosen values (skill names, resource URIs, prompt names) in therun: mcpc ...hints but never escaped a backslash. Inside POSIX double quotes\$(id)therefore rendered as"\\$(id)": a literal backslash followed by a live command substitution, and a trailing backslash escaped the closing quote. A malicious MCP server could make a pasted hint run a command.\on POSIX alongside", backtick and$; Windows keeps backslashes as path separators.sh.Fixes GHSA-wmqm-r8wm-9f34
🤖 Generated with Claude Code
https://claude.ai/code/session_01WMAPaE5empDFSAWVKwxmPE