RI-8322: plugin command sandbox bypass via startsWith()#6227
Merged
pawelangelow merged 2 commits intoJul 20, 2026
Conversation
The plugin command sandbox matched the command line against the read-only whitelist with startsWith(). Because "get" is whitelisted, GETDEL/GETEX/GETSET passed the check and let read-only plugins run destructive operations. Match the first command word exactly instead. Fixes #RI-8322 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7aa220db67
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Contributor
Code Coverage - Backend unit tests
Test suite run success3692 tests passing in 321 suites. Report generated by 🧪jest coverage report action from d6587ce |
Contributor
Code Coverage - Integration Tests
|
Addresses PR review: derive the command word with splitCliCommandLine
(same parser the executor uses) instead of split(' '), so validation and
execution agree on non-space delimiters (tab/newline/CR/NUL) and quoting.
Unparseable input stays rejected (fail closed).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
valkirilov
approved these changes
Jul 17, 2026
pawelangelow
deleted the
be/bugfix/RI-8322/plugin-command-sandbox-startswith
branch
July 20, 2026 06:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The Workbench plugin command sandbox validates commands against a whitelist of
read-only commands, but enforcement used
targetCommand.startsWith(command).Because
getis whitelisted, prefix matches likeGETDEL(reads + deletes),GETEX(modifies TTL), andGETSET(reads + overwrites) passed the checkdespite not being whitelisted — letting a read-only plugin execute destructive
operations and breaking the sandbox trust boundary.
Changes
startsWithmatcher with an exact command-word match:compare
commandLine.toLowerCase().split(' ')[0]against the whitelist using.includes(...).get foostill passes;getdel foono longer does.to their first token.
GETDEL/GETEX/GETSETare rejected whileGET(anycasing) is allowed.
implicit-
anytype errors; refreshed the API.tscheck.rec.jsonbaselineaccordingly (net decrease).
Note
High Risk
This is a security fix on plugin command authorization; incorrect matching could still allow destructive Redis commands from plugins or break legitimate read-only plugin behavior.
Overview
Fixes a plugin command sandbox bypass where whitelist checks used
startsWith, so commands likeGETDEL,GETEX, andGETSETcould pass whengetwas allowed.checkWhitelistedCommandsnow takes the first token viasplitCliCommandLine(same as the workbench executor), lowercases it, and requires an exactwhitelist.includesmatch instead of a prefix match. LegitimateGET(any casing, tab/space delimiters) still runs; prefix lookalikes are rejected beforesendCommand.Adds parameterized unit tests for those cases and tightens
plugins.service.spec.tsmock typing; drops the corresponding entries from.tscheck.rec.json.Reviewed by Cursor Bugbot for commit d6587ce. Bugbot is set up for automated code reviews on this repo. Configure here.