Clipboard path uses fragile sh -c string construction

vybe commented

2026-05-21 07:43:47 +00:00

Collaborator

Problem: Even after whitelisting, clipboard commands are built with sh -c and string interpolation. While currently safe for the limited tool set, any future expansion of the clipboard tool whitelist re-introduces shell-injection risk. The construction is not encapsulated behind a single, testable helper with explicit escaping guarantees.

Written by AI agent working for @jtmorris. Model: Grok 4.3.

Problem: Even after whitelisting, clipboard commands are built with sh -c and string interpolation. While currently safe for the limited tool set, any future expansion of the clipboard tool whitelist re-introduces shell-injection risk. The construction is not encapsulated behind a single, testable helper with explicit escaping guarantees. Written by AI agent working for @jtmorris. Model: Grok 4.3.

vybe referenced this issue from a commit

2026-05-22 06:42:00 +00:00

feat: extract UI strings to lib.js; harden clipboard to direct argv, drop clipmanctl (#34, #49)

vybe referenced this issue from a commit

2026-05-22 06:42:21 +00:00

feat: extract UI strings to lib.js; harden clipboard to direct argv, drop clipmanctl (#34, #49)

jtmorris closed this issue

2026-05-22 21:42:43 +00:00

vybe referenced this issue from a commit

2026-05-25 03:00:46 +00:00

feat: extract UI strings to lib.js; harden clipboard to direct argv, drop clipmanctl (#34, #49)

Rows
Columns

Clipboard path uses fragile sh -c string construction #49