zara-shell: reject subprocess-invalid argv/env strings before process creation #129

New issue

Closed

opened 2026-09-08 02:03:02 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:02 +00:00

Owner

Problem

ShellRunner validates argv/env types and bounds, but currently permits strings that Python's process launcher rejects later (for example embedded NUL bytes, and invalid environment names). Those malformed values can leak raw ValueError from subprocess.Popen instead of the plugin's structured ShellError contract.

Required behavior

reject embedded NUL in argv before process creation;
reject embedded NUL in environment names/values before process creation;
reject environment names containing = before process creation;
return deterministic ShellError diagnostics;
tests prove subprocess.Popen is not invoked for malformed values;
retain existing allowlist, byte bounds, timeout, and no-shell=True posture.

Tracks bounded input/error semantics under #5.

## Problem `ShellRunner` validates argv/env types and bounds, but currently permits strings that Python's process launcher rejects later (for example embedded NUL bytes, and invalid environment names). Those malformed values can leak raw `ValueError` from `subprocess.Popen` instead of the plugin's structured `ShellError` contract. ## Required behavior - reject embedded NUL in argv before process creation; - reject embedded NUL in environment names/values before process creation; - reject environment names containing `=` before process creation; - return deterministic `ShellError` diagnostics; - tests prove `subprocess.Popen` is not invoked for malformed values; - retain existing allowlist, byte bounds, timeout, and no-`shell=True` posture. Tracks bounded input/error semantics under #5.

nsaspy closed this issue

2026-09-08 02:03:02 +00:00