security hardening

Author: HaykWD

src/handler/repl.rs

@@ -89,7 +89,12 @@ impl<'a> ReplHandler<'a> {
                 break;
             }
             if self.shell_mode && prompt == "e" {
-                shell_cmd::run(&last_completion)?;
+                // Require a live confirmation on the controlling terminal before
+                // executing. Reading from /dev/tty (not stdin) means a piped REPL
+                // session cannot silently auto-execute a proposed command.
+                if crate::tools::confirm_tty(&last_completion) {
+                    shell_cmd::run(&last_completion)?;
+                }
                 continue;
             }
             if self.shell_mode && prompt == "d" {

src/main.rs

@@ -216,6 +216,13 @@ fn shell_confirmation_loop(
 ) -> Result<()> {
     use std::io::Write;
     loop {
+        // The completion was streamed to the terminal by the handler and could
+        // contain control bytes; reprint it sanitized next to the prompt so the
+        // user always sees the true command they are about to run.
+        println!(
+            "Command: {}",
+            render::sanitize_terminal_line(completion.trim())
+        );
         print!("[E]xecute, [M]odify, [D]escribe, [A]bort: ");
         std::io::stdout().flush().ok();
         let mut answer = String::new();

src/render.rs

@@ -1,5 +1,22 @@
 use std::io::{IsTerminal, Write};
 
+/// Escapes control bytes so model-controlled text cannot move the cursor or
+/// rewrite the screen to spoof what the user sees (e.g. an approval prompt).
+/// The result stays on a single line: ESC, CR, BS, newlines, tabs, and every
+/// other C0/C1 control are rendered literally as `\xNN`.
+pub fn sanitize_terminal_line(text: &str) -> String {
+    let mut out = String::with_capacity(text.len());
+    for ch in text.chars() {
+        let is_control = (ch as u32) < 0x20 || ch as u32 == 0x7f || (0x80..=0x9f).contains(&(ch as u32));
+        if is_control {
+            out.push_str(&format!("\\x{:02x}", ch as u32));
+        } else {
+            out.push(ch);
+        }
+    }
+    out
+}
+
 /// Minimal ANSI color support, mirroring the named colors shell_gpt exposes
 /// via `typer.secho(fg=...)`. Markdown/live-region rendering is a later phase.
 fn ansi_code(color: &str) -> &'static str {
@@ -60,3 +77,27 @@ impl TextPrinter {
         println!();
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::sanitize_terminal_line;
+
+    #[test]
+    fn escapes_cursor_control_sequences() {
+        let malicious = "\x1b[2K\rrm -rf ~";
+        let out = sanitize_terminal_line(malicious);
+        assert_eq!(out, "\\x1b[2K\\x0drm -rf ~");
+        assert!(!out.contains('\x1b'));
+        assert!(!out.contains('\r'));
+    }
+
+    #[test]
+    fn escapes_newlines_and_tabs() {
+        assert_eq!(sanitize_terminal_line("a\nb\tc"), "a\\x0ab\\x09c");
+    }
+
+    #[test]
+    fn ordinary_text_is_unchanged() {
+        assert_eq!(sanitize_terminal_line("ls -la /tmp"), "ls -la /tmp");
+    }
+}

src/tools.rs

@@ -3,6 +3,7 @@ use std::io::Write;
 use serde_json::json;
 
 use crate::client::{ToolCall, ToolDefinition, ToolFunctionDefinition};
+use crate::render::sanitize_terminal_line;
 use crate::shell_cmd;
 
 pub const MAX_TOOL_ROUNDS: usize = 8;
@@ -41,13 +42,55 @@ fn execute_shell(call: &ToolCall, no_interaction: bool) -> String {
 }
 
 fn confirm(command: &str) -> bool {
-    print!("Model wants to execute `{command}`. Execute? [y/N] ");
+    // The command is model-controlled; sanitize before display so control bytes
+    // cannot rewrite the prompt and spoof what is being approved.
+    print!(
+        "Model wants to execute `{}`. Execute? [y/N] ",
+        sanitize_terminal_line(command)
+    );
     std::io::stdout().flush().ok();
     let mut answer = String::new();
     std::io::stdin().read_line(&mut answer).ok();
+    is_yes(&answer)
+}
+
+/// True only for an explicit yes; anything else (incl. empty/EOF) denies.
+pub fn is_yes(answer: &str) -> bool {
     matches!(answer.trim().to_ascii_lowercase().as_str(), "y" | "yes")
 }
 
+/// Prompts on the controlling terminal (`/dev/tty`) — not stdin, which may be a
+/// pipe — to confirm executing a model-proposed `command`. Returns false,
+/// denying execution, when there is no controlling terminal to prompt on. The
+/// command is sanitized before display to prevent approval-prompt spoofing.
+pub fn confirm_tty(command: &str) -> bool {
+    use std::io::{BufRead, BufReader};
+
+    let tty = match std::fs::OpenOptions::new()
+        .read(true)
+        .write(true)
+        .open("/dev/tty")
+    {
+        Ok(tty) => tty,
+        Err(_) => {
+            eprintln!("Refusing to execute: no controlling terminal available to confirm.");
+            return false;
+        }
+    };
+    let mut writer = &tty;
+    let _ = write!(
+        writer,
+        "Execute `{}`? [y/N] ",
+        sanitize_terminal_line(command)
+    );
+    let _ = writer.flush();
+    let mut answer = String::new();
+    if BufReader::new(&tty).read_line(&mut answer).is_err() {
+        return false;
+    }
+    is_yes(&answer)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -64,4 +107,13 @@ mod tests {
     fn registry_exposes_the_shell_tool() {
         assert_eq!(definitions()[0].function.name, "execute_shell_command");
     }
+    #[test]
+    fn confirmation_denies_by_default() {
+        for yes in ["y", "yes", "Y", "YES", " yes \n"] {
+            assert!(is_yes(yes), "{yes:?} should confirm");
+        }
+        for no in ["", "\n", "n", "no", "sure", "yep", "yolo"] {
+            assert!(!is_yes(no), "{no:?} should deny");
+        }
+    }
 }