Remove shell expansion for git commands#447
Merged
Merged
Conversation
dkundel-openai
approved these changes
Jul 8, 2026
HerbertGao
added a commit
to HerbertGao/codex-plugin-cc
that referenced
this pull request
Jul 8, 2026
- v1.0.6 (PR openai#447): git commands no longer pass through a shell (shell: false) - Resolved version conflicts to 1.0.6-herbertgao.1 (fork suffix convention) - Preserved fork's codex-rescue foreground-forcing customization (untouched by v1.0.6) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
DKalien
added a commit
to DKalien/codex-plugin-cc
that referenced
this pull request
Jul 8, 2026
- Merge upstream security fix: remove shell expansion for git commands (openai#447) - Add options.shell override support in runCommand - Update version to 1.0.6.1 - Keep local Node.js v25 compatibility improvements
Jafee
added a commit
to Jafee/codex-plugin-cc-stable
that referenced
this pull request
Jul 8, 2026
Port of openai/codex-plugin-cc v1.0.6 (net diff 80c31f9..db52e28, PR openai#447). On win32 runCommand defaulted to shell: process.env.SHELL || true, so git()/gitChecked() ran repository-derived arguments (baseRef, branch names, paths) through cmd.exe or the user's shell — a malicious repo could inject commands via a crafted default-branch name. git commands now force shell: false (after the options spread, so callers cannot override it back); runCommand and the test helper honor an explicit options.shell via ?? while keeping the old platform default otherwise. Regression test: a branch named main&branch-helper&x must reach git literally and never execute the repo-local branch-helper.cmd. Fork notes: tests/helpers.mjs merged with the fork's timeout option; upstream version hunks replaced by the fork's own versioning. This supersedes HOLD item openai#294 (same root cause, fixed at the source). Dual review: Claude (Fable 5) APPROVE + Codex (gpt-5.5 xhigh, fresh read-only, pinned-SHA static audit) APPROVE. Clean-env suite 124/124. Co-Authored-By: bryane-oai <bryane@openai.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Crazytieguy
added a commit
to Crazytieguy/codex-plugin-cc
that referenced
this pull request
Jul 9, 2026
…ture Adopted: - Remove shell expansion for git commands (upstream openai#447): git spawns now pass shell: false via an options.shell passthrough in lib/process.mjs and tests/helpers.mjs, composed with our resolveWindowsShell() on win32. Includes upstream's regression test for branch names with shell metacharacters. - app-server.mjs: append captured stderr to "app-server exited unexpectedly" errors. Rejected: - /codex:transfer Claude-session-to-Codex-thread feature (upstream openai#374): transferring Claude-generated assistant turns into a Codex thread puts Codex out of distribution; also couples to Codex's private import ledger. All transfer code, command, protocol types, fixtures, and tests dropped. - Upstream version bumps and identity churn (package.json, marketplace, plugin.json, README) per fork policy. Post-merge fixes: - Dropped upstream's requestAttestation: false capability — the checked-in generated InitializeCapabilities type doesn't define it, so it broke the tsc build (found by Codex review). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LE4prC9U5Snku24TXbUfYr
AK25789
added a commit
to AK25789/mx-codex4ada
that referenced
this pull request
Jul 15, 2026
Same hardening upstream applied to the codex commands (openai#168/openai#447 family): unquoted $ARGUMENTS is subject to shell word-splitting and glob expansion. Found by Mira during the pre-rebase consultation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
zknpr
added a commit
to zknpr/codex-plugin-cc
that referenced
this pull request
Jul 16, 2026
Brings the branch onto v1.0.6: session transfer (openai#374), 1.0.5/1.0.6 bumps, and no-shell-expansion for git commands (openai#447). Conflicts resolved in codex-companion.mjs (workspace-boundary notice + transfer dispatch coexist) and lib/app-server.mjs (child exit deregisters the host-exit reaper AND carries captured stderr in protocol errors). Full suite green: 124/124. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ensure Git commands are executed directly on Windows instead of being routed through a shell.
Git reference names can contain characters that Windows shells interpret specially. Passing those references through
shell: truecan therefore change the meaning of an otherwise valid Git command. This change keeps Git arguments as a literal argv array by forcingshell: falsein the shared Git helpers.Historical context
Windows npm installations expose tools such as
npmandcodexthrough.cmdshims, which Node cannot launch directly in some configurations.shell: truefor the shared synchronous command runner so Windows could resolve those shims.SHELL, preserving compatibility with Git Bash.Those changes fixed important Windows behavior, but the shared command runner also handles Git. Unlike
npmandcodex, Git is directly executable on Windows and does not need shell-based.cmdresolution.Changes
runCommandto override its shell setting.shell: falsein both Git command helpers.The regression test verifies that the branch name is passed to Git literally and that an adjacent command helper is not executed.
Compatibility
The existing Windows behavior remains unchanged for commands that require it:
.cmddiscovery continues to use the configured Windows shell.SHELLfor Git Bash users.This approach avoids restricting valid Git reference names and confines the change to the command path that does not require shell expansion.
Validation
npm test: 91 tests passedgit diff --check: clean