Skip to content

agentHost: Validate strings in bash commands#307699

Merged
roblourens merged 1 commit intomainfrom
roblou/right-baboon
Apr 3, 2026
Merged

agentHost: Validate strings in bash commands#307699
roblourens merged 1 commit intomainfrom
roblou/right-baboon

Conversation

@roblourens
Copy link
Copy Markdown
Member

Co-authored-by: Copilot copilot@github.com

Co-authored-by: Copilot <copilot@github.com>
@roblourens roblourens enabled auto-merge (squash) April 3, 2026 19:28
@roblourens roblourens self-assigned this Apr 3, 2026
Copilot AI review requested due to automatic review settings April 3, 2026 19:29
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Tightens command construction in the SSH remote agent-host bootstrap flow by validating productService.quality before using it in unquoted shell paths, and by consistently shell-escaping the CLI download URL.

Changes:

  • Add a validateShellToken helper to ensure quality is safe to interpolate into unquoted shell path segments.
  • Route getRemoteCLIDir / getRemoteCLIBin through the validation helper.
  • Use shellEscape(url) when building the remote curl | tar install command.
Show a summary per file
File Description
src/vs/platform/agentHost/node/sshRemoteAgentHostService.ts Validates quality for safe shell interpolation and strengthens URL escaping in the remote CLI install command.

Copilot's findings

  • Files reviewed: 1/1 changed files
  • Comments generated: 0

@roblourens roblourens merged commit b564ded into main Apr 3, 2026
33 of 34 checks passed
@roblourens roblourens deleted the roblou/right-baboon branch April 3, 2026 22:14
@vs-code-engineering vs-code-engineering bot added this to the 1.115.0 milestone Apr 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants