From 1839c0e95d1d00ea13cf5d800cf440e810d4cbdd Mon Sep 17 00:00:00 2001 From: B <6723574+louisgv@users.noreply.github.com> Date: Thu, 26 Mar 2026 11:08:59 +0000 Subject: [PATCH] fix(security): add base64 validation guards in orchestrate.ts (fixes #3006) Add /^[A-Za-z0-9+/=]+$/ validation after each .toString("base64") call in delegateCloudCredentials() and injectEnvVars(), consistent with the pattern established in agent-setup.ts by #2988. Agent: security-auditor Co-Authored-By: Claude Sonnet 4.6 --- packages/cli/package.json | 2 +- packages/cli/src/shared/orchestrate.ts | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/packages/cli/package.json b/packages/cli/package.json index 12e4d3b9..a146a0fa 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@openrouter/spawn", - "version": "0.26.9", + "version": "0.26.10", "type": "module", "bin": { "spawn": "cli.js" diff --git a/packages/cli/src/shared/orchestrate.ts b/packages/cli/src/shared/orchestrate.ts index 233466fc..14733254 100644 --- a/packages/cli/src/shared/orchestrate.ts +++ b/packages/cli/src/shared/orchestrate.ts @@ -191,6 +191,9 @@ export async function delegateCloudCredentials(runner: CloudRunner, _cloudName: for (const file of filesToDelegate) { const content = readFileSync(file.localPath, "utf-8"); const b64 = Buffer.from(content).toString("base64"); + if (!/^[A-Za-z0-9+/=]+$/.test(b64)) { + throw new Error("Unexpected characters in base64 output"); + } const writeResult = await asyncTryCatch(() => runner.runServer(`printf '%s' '${b64}' | base64 -d > ${file.remotePath} && chmod 600 ${file.remotePath}`), ); @@ -498,6 +501,9 @@ export async function runOrchestration( async function injectEnvVars(cloud: CloudOrchestrator, envContent: string): Promise { logStep("Setting up environment variables..."); const envB64 = Buffer.from(envContent).toString("base64"); + if (!/^[A-Za-z0-9+/=]+$/.test(envB64)) { + throw new Error("Unexpected characters in base64 output"); + } const isLocalWindows = cloud.cloudName === "local" && isWindows(); const envSetupCmd = isLocalWindows