gemini-cli - 💡(How to fix) Fix Robust shell command parsing to prevent injection bypasses

What happened?

The detectCommandSubstitution function in packages/core/src/utils/shell-utils.ts uses manual string parsing and regular expressions to detect and block command substitution syntax (e.g., $(), backticks, <()).

Manual parsing of shell syntax is inherently brittle and often bypassable. For example:

• It might not handle all edge cases of nested quoting correctly.
• It doesn't handle shell-specific features or redirections that could lead to unexpected execution if the sandbox is weak or disabled.
• On PowerShell, the logic attempts to block subexpressions but might miss certain obfuscation techniques.

While the primary defense is the OS-level sandbox (Seatbelt on macOS, Low Integrity/Restricted Tokens on Windows), relying on regex-based detection for "Command Injection" is a risky secondary defense.

What did you expect to happen?

Shell commands should be parsed by a robust, formal grammar parser (like tree-sitter, which is already used in other parts of shell-utils.ts) to reliably identify all sub-commands and redirections.

Alternatively, the system should rely entirely on the sandbox for security and treat model-generated shell commands as potentially dangerous by design, rather than attempting to filter specific patterns at the string level.

Technical Details

The current implementation in packages/core/src/utils/shell-utils.ts relies on detectCommandSubstitution.

Affected Files

• packages/core/src/utils/shell-utils.ts
• packages/core/src/tools/shell.ts

Recommended Approach

Use the existing tree-sitter integration to properly tokenize and parse shell commands instead of using regex for security-critical checks.

Client information

Platform: All Version: Latest

Login information

N/A

Anything else we need to know?

Bypass Example (Hypothetical): If the parser misses a specific quoting combination or a shell-specific operator (like & or | if they aren't fully accounted for), an attacker could potentially chain commands despite the detection.

Proposed Fix:

• Replace manual regex parsing with formal tree-sitter based analysis to detect subshells and substitutions.
• Strengthen the sandbox defaults to ensure that even if a subshell is executed, it remains within strict boundaries.