Skip to content

fix: avoid shelling out for directory views#418

Open
he-yufeng wants to merge 1 commit into
bytedance:mainfrom
he-yufeng:fix/text-editor-directory-view-shell
Open

fix: avoid shelling out for directory views#418
he-yufeng wants to merge 1 commit into
bytedance:mainfrom
he-yufeng:fix/text-editor-directory-view-shell

Conversation

@he-yufeng

Copy link
Copy Markdown

Summary

Fixes #376.

This removes the shell find call from directory views in both text editor tool implementations. Directory listing is now done through pathlib, so a directory name containing shell metacharacters is treated as a path instead of command text.

I kept the existing behavior of listing visible items up to two levels deep and skipping hidden path components.

To verify

  • PYTHONPATH=. uv run --extra test --extra evaluation python -m pytest tests/tools/test_edit_tool.py -q
  • uv run ruff check trae_agent\tools\edit_tool.py trae_agent\tools\edit_tool_cli.py tests\tools\test_edit_tool.py
  • uv run ruff format --check trae_agent\tools\edit_tool.py trae_agent\tools\edit_tool_cli.py tests\tools\test_edit_tool.py
  • uv run python -m py_compile trae_agent\tools\edit_tool.py trae_agent\tools\edit_tool_cli.py tests\tools\test_edit_tool.py
  • git diff --check

@CLAassistant

CLAassistant commented May 29, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security] Command Injection in TextEditorTool._view() via malicious directory names

2 participants