search

Ironclad / rivet

The open-source visual AI programming environment and TypeScript library
https://rivet.ironcladapp.com
MIT License
2.75k stars 241 forks source link

[Bug]: FS - Shell Command doesn't handle ".." path #225

Open DjWarmonger opened 1 year ago

DjWarmonger commented 1 year ago

What happened?

Shell Command node failed to resolve a valid path containing ...

What was the expected functionality?

Valid shell path woudl be handled as in any normal shell. The same command works with default WIndows shell (not PowerShell or some such).

Describe your environment

Windows 11, default command prompt cp comes from Git Bash installation.

Relevant log output

No response

Relevant screenshots

image

Code of Conduct

abrenneke commented 1 year ago

Hey @DjWarmonger this is intentional, to add a tiiiny bit of security to the node. The intention is that an LLM couldn't accidentally break out of the working directory you set for it and cause your system harm. In your case the path is equivalent to F:/AI/Rivet/CV-bot/CV_tex/cv_template.tex so you could just use that without navigating up a directory?

codemile commented 11 months ago

You could make this restriction togglable and set the default to true but I think such a restriction doesn't make sense. The idea of restricting ".." is very subjective, because I find it communicates a false sense of security. It's by far better to say "Warning: executing ANY commands on the shell is a security risk and use at your own risk" and then offer no restrictions.

It shouldn't be Rivet's job to act as a security layer for projects performing shell commands. It's better to admit you can't offer any security and let the developer figure it out.

abrenneke commented 11 months ago

You're probably right, I accept pull requests!