chore: sync core lib and CLAUDE.md from agent-core#9
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request integrates a new binary management system, enabling the lazy downloading and execution of the Highlights
Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request syncs the core library from agent-core, notably adding a new binary resolver module. The new module is well-structured and handles downloading and managing a Rust binary dependency. I've found a couple of logic issues in the version checking that could prevent the binary from being updated correctly, and a potential command injection vulnerability on Windows. My review includes suggestions to fix these issues.
|
|
||
| if (fs.existsSync(binPath)) { | ||
| const ver = getVersion(); | ||
| if (meetsMinimumVersion(ver, ANALYZER_MIN_VERSION)) { |
There was a problem hiding this comment.
The check for the minimum version always uses ANALYZER_MIN_VERSION. If a specific options.version is passed that is higher than ANALYZER_MIN_VERSION, and the currently installed version meets ANALYZER_MIN_VERSION but not options.version, the binary will not be updated. The check should be against the targetVer.
| if (meetsMinimumVersion(ver, ANALYZER_MIN_VERSION)) { | |
| if (meetsMinimumVersion(ver, targetVer)) { |
| if (fs.existsSync(binPath)) { | ||
| const ver = getVersion(); | ||
| if (meetsMinimumVersion(ver, ANALYZER_MIN_VERSION)) { | ||
| return binPath; | ||
| } | ||
| } | ||
|
|
||
| const targetVer = (options && options.version) || ANALYZER_MIN_VERSION; |
There was a problem hiding this comment.
The check for the minimum version always uses ANALYZER_MIN_VERSION. If a specific options.version is passed that is higher than ANALYZER_MIN_VERSION, and the currently installed version meets ANALYZER_MIN_VERSION but not options.version, the binary will not be updated. The check should be against targetVer. You should define targetVer before the check.
| if (fs.existsSync(binPath)) { | |
| const ver = getVersion(); | |
| if (meetsMinimumVersion(ver, ANALYZER_MIN_VERSION)) { | |
| return binPath; | |
| } | |
| } | |
| const targetVer = (options && options.version) || ANALYZER_MIN_VERSION; | |
| const targetVer = (options && options.version) || ANALYZER_MIN_VERSION; | |
| if (fs.existsSync(binPath)) { | |
| const ver = getVersion(); | |
| if (meetsMinimumVersion(ver, targetVer)) { | |
| return binPath; | |
| } | |
| } |
| return new Promise(function(resolve, reject) { | ||
| const tmpZip = path.join(os.tmpdir(), binaryName + '-' + Date.now() + '.zip'); | ||
| fs.writeFileSync(tmpZip, buf); | ||
| const cmd = 'Expand-Archive -Path \'' + tmpZip + '\' -DestinationPath \'' + destDir + '\' -Force'; |
There was a problem hiding this comment.
Constructing a shell command by concatenating strings is dangerous and can lead to command injection vulnerabilities. If tmpZip or destDir contain special characters like a single quote, it could break the command or allow arbitrary code execution. Although the inputs are currently from trusted sources (os.tmpdir(), os.homedir()), a user's home directory could potentially contain such characters (e.g., a username like d'arcy).
To fix this, you should escape any single quotes in the path variables before inserting them into the PowerShell command string. In PowerShell, a single quote is escaped by doubling it ('').
| const cmd = 'Expand-Archive -Path \'' + tmpZip + '\' -DestinationPath \'' + destDir + '\' -Force'; | |
| const cmd = 'Expand-Archive -Path \'' + tmpZip.replace(/'/g, "''") + '\' -DestinationPath \'' + destDir.replace(/'/g, "''") + '\' -Force'; |
1 participant
Automated sync of lib/ and CLAUDE.md from agent-core.