sec: remove 'go' from safe programs (#820)
It could be used to prompt inject commands e.g. `go test -exec`.
Plus, we don't have other languages there, so I think we remove Go as
well.
Ideally, we could ask haiku if the command is read only or not, and ask
for perms based on that, but for now I think this will do.
Thanks Will Vandevanter for the report.
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
commit74bcdaff28e591e39b0162e5f45a9618f25133ed
authorCarlos Alexandro Becker <caarlos0@users.noreply.github.com>
dateMon 18 Aug 2025, 17:23 (1 year ago)
parentd86f739
internal/llm/tools/safe.go−15
@@ -52,21 +52,6 @@ var safeCommands = []string{
5252 "git show",
5353 "git status",
5454 "git tag",
55−
56− // Go
57− "go build",
58− "go clean",
59− "go doc",
60− "go env",
61− "go fmt",
62− "go help",
63− "go install",
64− "go list",
65− "go mod",
66− "go run",
67− "go test",
68− "go version",
69− "go vet",
7055}
7156
7257func init() {