fix(patch): cherry-pick 3627f47 to release/v0.41.0-pr-26542 to patch version v0.41.0 and create version 0.41.1#26545
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request cherry-picks a fix into the v0.41.0 release branch to address an issue where redirected shell commands were incorrectly triggering user approval prompts in trusted modes. By removing the dependency on sandbox status for these specific approval modes, the engine now consistently respects the intended behavior of YOLO and AUTO_EDIT configurations. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the PolicyEngine to prevent downgrading redirected shell commands to ASK_USER when in AUTO_EDIT or YOLO modes, regardless of whether a sandbox is enabled. A security concern was raised regarding the removal of the sandbox check for AUTO_EDIT mode, as it could allow an agent to perform unauthorized file writes on the host system; a code suggestion was provided to maintain the sandbox requirement for AUTO_EDIT while allowing the bypass for YOLO mode.
| if ( | ||
| sandboxEnabled && | ||
| (this.approvalMode === ApprovalMode.AUTO_EDIT || | ||
| this.approvalMode === ApprovalMode.YOLO) | ||
| this.approvalMode === ApprovalMode.AUTO_EDIT || | ||
| this.approvalMode === ApprovalMode.YOLO | ||
| ) { | ||
| return false; | ||
| } |
There was a problem hiding this comment.
The removal of the sandboxEnabled check in shouldDowngradeForRedirection allows shell commands with redirections to be automatically allowed in AUTO_EDIT mode even when no sandbox is present. This enables an agent to perform arbitrary file writes on the host system by using redirections (e.g., >) with otherwise 'safe' commands. While dangerous commands are intentionally allowed in YOLO mode without a sandbox, AUTO_EDIT should still require a sandbox or user approval for such operations to maintain a secure posture.
| if ( | |
| sandboxEnabled && | |
| (this.approvalMode === ApprovalMode.AUTO_EDIT || | |
| this.approvalMode === ApprovalMode.YOLO) | |
| this.approvalMode === ApprovalMode.AUTO_EDIT || | |
| this.approvalMode === ApprovalMode.YOLO | |
| ) { | |
| return false; | |
| } | |
| const sandboxEnabled = !(this.sandboxManager instanceof NoopSandboxManager); | |
| if ( | |
| this.approvalMode === ApprovalMode.YOLO || | |
| (sandboxEnabled && this.approvalMode === ApprovalMode.AUTO_EDIT) | |
| ) { | |
| return false; | |
| } |
References
- In YOLO mode, dangerous commands are intentionally allowed to proceed with an 'ALLOW' decision, even when no sandbox is active. This overrides the default behavior of forcing an 'ASK_USER' decision for such commands.
|
Size Change: -105 B (0%) Total Size: 33.9 MB
ℹ️ View Unchanged
|
galz10
deleted the
hotfix/v0.41.0/0.41.1/stable/cherry-pick-3627f47/pr-26542
branch
2 participants
This PR automatically cherry-picks commit 3627f47 to patch version v0.41.0 in the stable release to create version 0.41.1.