git.iko.soy/crush
on main help sign in
fix(shell): block `go test -exec` and ensure it works using equals
commitb4492299c17d11c6beb9663344f5d79f8f1f1e8c authorAndrey Nering <andreynering@users.noreply.github.com> dateMon 18 Aug 2025, 15:38 (1 year ago) parentcbdd2e5
3 files changed+45−1
compare with main
unifiedsplit
internal/llm/tools/bash.go+3 internal/shell/command_block_test.go+36 internal/shell/shell.go+6−1
internal/llm/tools/bash.go+3
@@ -298,6 +298,9 @@ func blockFuncs() []shell.BlockFunc {
298298 shell.ArgumentsBlocker("pnpm", []string{"add"}, []string{"--global"}),
299299 shell.ArgumentsBlocker("pnpm", []string{"add"}, []string{"-g"}),
300300 shell.ArgumentsBlocker("yarn", []string{"global", "add"}, nil),
301+
302+ // `go test -exec` can run arbitrary commands
303+ shell.ArgumentsBlocker("go", []string{"test"}, []string{"-exec"}),
301304 }
302305}
303306
internal/shell/command_block_test.go+36
@@ -231,6 +231,24 @@ func TestArgumentsBlocker(t *testing.T) {
231231 input: []string{"pacman", "-Q", "package"},
232232 shouldBlock: false,
233233 },
234+
235+ // `go test -exec`
236+ {
237+ name: "go test exec",
238+ cmd: "go",
239+ args: []string{"test"},
240+ flags: []string{"-exec"},
241+ input: []string{"go", "test", "-exec", "bash -c 'echo hello'"},
242+ shouldBlock: true,
243+ },
244+ {
245+ name: "go test exec",
246+ cmd: "go",
247+ args: []string{"test"},
248+ flags: []string{"-exec"},
249+ input: []string{"go", "test", `-exec="bash -c 'echo hello'"`},
250+ shouldBlock: true,
251+ },
234252 }
235253
236254 for _, tt := range tests {
@@ -329,6 +347,24 @@ func TestSplitArgsFlags(t *testing.T) {
329347 wantArgs: []string{"package"},
330348 wantFlags: []string{"-S"},
331349 },
350+ {
351+ name: "flag with equals sign",
352+ input: []string{"-exec=bash", "package"},
353+ wantArgs: []string{"package"},
354+ wantFlags: []string{"-exec"},
355+ },
356+ {
357+ name: "long flag with equals sign",
358+ input: []string{"--config=/path/to/config", "run"},
359+ wantArgs: []string{"run"},
360+ wantFlags: []string{"--config"},
361+ },
362+ {
363+ name: "flag with complex value",
364+ input: []string{`-exec="bash -c 'echo hello'"`, "test"},
365+ wantArgs: []string{"test"},
366+ wantFlags: []string{"-exec"},
367+ },
332368 }
333369
334370 for _, tt := range tests {
internal/shell/shell.go+6−1
@@ -197,7 +197,12 @@ func splitArgsFlags(parts []string) (args []string, flags []string) {
197197 flags = make([]string, 0, len(parts))
198198 for _, part := range parts {
199199 if strings.HasPrefix(part, "-") {
200− flags = append(flags, part)
200+ // Extract flag name before '=' if present
201+ flag := part
202+ if idx := strings.IndexByte(part, '='); idx != -1 {
203+ flag = part[:idx]
204+ }
205+ flags = append(flags, flag)
201206 } else {
202207 args = append(args, part)
203208 }