ling/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-04-28 06:51:16 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #151 from johnh4098/fix/shell-injection-spawn-via-env-v2

Browse Source 
fix(process): escape single quotes in spawn_via_env bg_command
This commit is contained in:
Teknium
2026-02-27 22:49:04 -08:00
committed by GitHub
parent 306c6706a6 e5f719a33b
commit 7f423508e4
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
tools/process_registry.py
View File

@@ -247,8 +247,9 @@ class ProcessRegistry:
# Run the command in the sandbox with output capture
log_path = f"/tmp/hermes_bg_{session.id}.log"
pid_path = f"/tmp/hermes_bg_{session.id}.pid"
safe_command = command.replace("'", "'\''")
bg_command = (
f"nohup bash -c '{command}' > {log_path} 2>&1 & "
f"nohup bash -c '{safe_command}' > {log_path} 2>&1 & "
f"echo $! > {pid_path} && cat {pid_path}"
)