openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-09 20:50:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: tighten shell wrapper detection

Browse Source 
Use exact matches for known shell wrappers so command display and approval keys do not treat arbitrary shell-like paths as trusted wrappers.

Co-authored-by: Codex <noreply@openai.com>
This commit is contained in:
viyatb-oai
2026-04-15 14:04:07 -07:00
co-authored by Codex
parent 66533ddc61
commit 25cf5d7c60
9 changed files with 161 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/src/shell_detect.rs
+27 -17
View File
@@ -1,24 +1,34 @@
use crate::shell::ShellType;
use std::path::Path;
use std::path::PathBuf;
pub(crate) fn detect_shell_type(shell_path: &PathBuf) -> Option<ShellType> {
match shell_path.as_os_str().to_str() {
Some("zsh") => Some(ShellType::Zsh),
Some("sh") => Some(ShellType::Sh),
Some("cmd") => Some(ShellType::Cmd),
Some("bash") => Some(ShellType::Bash),
Some("pwsh") => Some(ShellType::PowerShell),
Some("powershell") => Some(ShellType::PowerShell),
_ => {
let shell_name = shell_path.file_stem();
if let Some(shell_name) = shell_name {
let shell_name_path = Path::new(shell_name);
if shell_name_path != Path::new(shell_path) {
return detect_shell_type(&shell_name_path.to_path_buf());
}
}
None
let shell_text = shell_path.as_os_str().to_str()?;
// Keep this exact: repo-local files named like shells must not inherit
// shell-wrapper trust in approval or display decisions.
match shell_text {
"zsh" | "/bin/zsh" | "/usr/bin/zsh" | "/usr/local/bin/zsh" | "/opt/homebrew/bin/zsh" => {
Some(ShellType::Zsh)
}
"sh" | "/bin/sh" | "/usr/bin/sh" => Some(ShellType::Sh),
"bash"
| "/bin/bash"
| "/usr/bin/bash"
| "/usr/local/bin/bash"
| "/opt/homebrew/bin/bash" => Some(ShellType::Bash),
"pwsh"
| "powershell"
| "pwsh.exe"
| "powershell.exe"
| "/usr/local/bin/pwsh"
| "/usr/bin/pwsh"
| "/bin/pwsh"
| "/opt/homebrew/bin/pwsh" => Some(ShellType::PowerShell),
"cmd" | "cmd.exe" => Some(ShellType::Cmd),
_ => match shell_text.replace('\\', "/").to_ascii_lowercase().as_str() {
"c:/windows/system32/cmd.exe" => Some(ShellType::Cmd),
"c:/windows/system32/windowspowershell/v1.0/powershell.exe"
| "c:/program files/powershell/7/pwsh.exe" => Some(ShellType::PowerShell),
_ => None,
},
}
}