wuyang/zk-data-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add comprehensive security tests for agent_tools.py

Browse Source 
- Add 26 tests covering _resolve_path, _ensure_shell_allowed, and
  _is_sensitive_env_var across path traversal, destructive command
  blocking, and secret-name detection.
- Fix bug in _ensure_shell_allowed: regex patterns for chmod -R and
  chown -R used uppercase -R but the command is lowered before matching,
  so these patterns never matched. Changed to lowercase -r.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: abdoelsayed2016 <27821589+abdoelsayed2016@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-04-05 16:14:22 +00:00
committed by GitHub
parent 42abcde18c
commit 696f272b88
2 changed files with 236 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/agent_tools.py
+2 -2
View File
@@ -910,8 +910,8 @@ def _ensure_shell_allowed(command: str, context: ToolExecutionContext) -> None:
r'(^|[;&|])\s*shutdown\s',
r'(^|[;&|])\s*reboot\s',
r'(^|[;&|])\s*mkfs',
r'(^|[;&|])\s*chmod\s+-R\s+777',
r'(^|[;&|])\s*chown\s+-R',
r'(^|[;&|])\s*chmod\s+-r\s+777',
r'(^|[;&|])\s*chown\s+-r',
r'(^|[;&|])\s*git\s+reset\s+--hard',
r'(^|[;&|])\s*git\s+clean\s+-fd',
r'(^|[;&|])\s*:\s*>\s*',