From f4a7079e65e8c00f883bc9ea8bc9fed9f96f8734 Mon Sep 17 00:00:00 2001 From: michaelxer Date: Sun, 28 Jun 2026 23:49:01 +0700 Subject: [PATCH] fix(security): use re.fullmatch per segment instead of re.search Fixes chengyongru's review concern: re.search is more permissive than the original re.fullmatch behavior for single-segment commands. Using re.fullmatch per segment preserves backward compatibility while still fixing the chained-command bypass. --- nanobot/agent/tools/shell.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nanobot/agent/tools/shell.py b/nanobot/agent/tools/shell.py index 26fb9fa9..37d16e1b 100644 --- a/nanobot/agent/tools/shell.py +++ b/nanobot/agent/tools/shell.py @@ -759,7 +759,7 @@ class ExecTool(Tool): # only explicitly allowed when every top-level shell segment matches. segments = self._split_shell_segments(lower) explicitly_allowed = bool(self.allow_patterns) and bool(segments) and all( - any(re.search(pattern, segment) for pattern in self.allow_patterns) + any(re.fullmatch(pattern, segment) for pattern in self.allow_patterns) for segment in segments ) if not explicitly_allowed: