cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [security] Environment variable default value injection vulnerability in ActorConfiguration #7056

New issue

Open

opened 2026-04-10 07:27:30 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-10 07:27:30 +00:00

Owner

Background and Context

The environment variable interpolation system in ActorConfiguration has a security vulnerability that allows injection of arbitrary content through default values in environment variable substitution patterns.

The _interpolate_env_vars method in src/cleveragents/actor/config.py uses a replace_env_var inner function to handle ${VAR:default} patterns. When the environment variable is not set, the default value is returned without any validation, allowing a malicious actor YAML to inject shell metacharacters, path traversal sequences, or other dangerous content that may be processed downstream by shell commands or other systems expecting sanitized input.

Current Behavior

The replace_env_var function (approximately lines 180–200 of src/cleveragents/actor/config.py) returns the raw default value string without sanitization:

def replace_env_var(match: re.Match[str]) -> str:
    env_var = match.group(1)
    default_value = match.group(2) if match.group(2) is not None else None

    env_value = os.environ.get(env_var)
    if env_value is None:
        if default_value is not None:
            # VULNERABLE: No validation on default_value content
            if default_value.lower() in {"true", "false"}:
                return str(default_value.lower() == "true")
            if default_value.lstrip("-").isdigit():
                return default_value
            return default_value  # <- Arbitrary string returned without validation

Attack vector: A malicious actor YAML could contain:

name: "test/actor"
model: "${MISSING_VAR:$(malicious_command)}"

When MISSING_VAR is not set, the default value $(malicious_command) is returned without validation, which could later be processed by shell commands or other systems expecting sanitized input.

Expected Behavior

Default values in ${VAR:default} patterns must be validated before use:

Dangerous shell metacharacters ($, `, (, ), |, ;, &, >, <, \) must be rejected or escaped.
Path traversal sequences (../, ..\\) must be rejected.
Only simple string literals (alphanumeric, hyphens, underscores, dots, colons, slashes for paths) should be permitted as default values.
Validation failure must raise a descriptive ValueError (fail-fast, no silent acceptance).

Acceptance Criteria

_interpolate_env_vars / replace_env_var validates default values against a strict allowlist or denylist of dangerous patterns before returning them
Shell metacharacters in default values cause a ValueError to be raised with a clear message identifying the offending pattern
Path traversal sequences in default values are rejected
Valid simple literals (strings, numbers, booleans, dotted names) continue to work correctly
All existing actor YAML parsing tests continue to pass
New BDD scenarios cover the injection attack vector and the validation logic
All nox stages pass
Coverage ≥ 97%

Metadata

Branch: bugfix/m3-actor-config-env-var-default-injection
Commit Message: fix(actors): validate env var default values in ActorConfiguration to prevent injection
Milestone: v3.2.0
Parent Epic: #400

Subtasks

Audit _interpolate_env_vars and replace_env_var in src/cleveragents/actor/config.py for all code paths that return default values
Define and implement a _validate_env_var_default(value: str) -> None helper that raises ValueError on dangerous patterns
Apply validation in replace_env_var before returning any default value
Write BDD scenarios (Behave) covering: shell metacharacter injection, path traversal, valid defaults, missing var with no default
Write Robot Framework integration test confirming actor YAML with malicious default is rejected at load time
Run nox and confirm all stages pass with coverage ≥ 97%

Definition of Done

_validate_env_var_default helper implemented and applied in replace_env_var
Shell metacharacters and path traversal sequences in default values raise ValueError
Valid default values (booleans, integers, simple strings) continue to work
BDD scenarios added covering injection attack vector
Robot Framework integration test added
All nox stages pass
Coverage ≥ 97%

Note (Bug Fix Workflow): Per CONTRIBUTING.md, this Type/Bug issue requires a companion Type/Testing TDD issue (prefixed TDD:) that writes a @tdd_expected_fail scenario capturing the vulnerability before the fix is implemented. The TDD issue must be created and merged first; this bug fix issue depends on it.

Automated by CleverAgents Bot
Supervisor: Acting on behalf of: UAT Testing | Agent: new-issue-creator

## Background and Context The environment variable interpolation system in `ActorConfiguration` has a security vulnerability that allows injection of arbitrary content through default values in environment variable substitution patterns. The `_interpolate_env_vars` method in `src/cleveragents/actor/config.py` uses a `replace_env_var` inner function to handle `${VAR:default}` patterns. When the environment variable is not set, the default value is returned **without any validation**, allowing a malicious actor YAML to inject shell metacharacters, path traversal sequences, or other dangerous content that may be processed downstream by shell commands or other systems expecting sanitized input. ## Current Behavior The `replace_env_var` function (approximately lines 180–200 of `src/cleveragents/actor/config.py`) returns the raw default value string without sanitization: ```python def replace_env_var(match: re.Match[str]) -> str: env_var = match.group(1) default_value = match.group(2) if match.group(2) is not None else None env_value = os.environ.get(env_var) if env_value is None: if default_value is not None: # VULNERABLE: No validation on default_value content if default_value.lower() in {"true", "false"}: return str(default_value.lower() == "true") if default_value.lstrip("-").isdigit(): return default_value return default_value # <- Arbitrary string returned without validation ``` **Attack vector**: A malicious actor YAML could contain: ```yaml name: "test/actor" model: "${MISSING_VAR:$(malicious_command)}" ``` When `MISSING_VAR` is not set, the default value `$(malicious_command)` is returned without validation, which could later be processed by shell commands or other systems expecting sanitized input. ## Expected Behavior Default values in `${VAR:default}` patterns must be validated before use: 1. Dangerous shell metacharacters (`$`, `` ` ``, `(`, `)`, `|`, `;`, `&`, `>`, `<`, `\`) must be rejected or escaped. 2. Path traversal sequences (`../`, `..\\`) must be rejected. 3. Only simple string literals (alphanumeric, hyphens, underscores, dots, colons, slashes for paths) should be permitted as default values. 4. Validation failure must raise a descriptive `ValueError` (fail-fast, no silent acceptance). ## Acceptance Criteria - [ ] `_interpolate_env_vars` / `replace_env_var` validates default values against a strict allowlist or denylist of dangerous patterns before returning them - [ ] Shell metacharacters in default values cause a `ValueError` to be raised with a clear message identifying the offending pattern - [ ] Path traversal sequences in default values are rejected - [ ] Valid simple literals (strings, numbers, booleans, dotted names) continue to work correctly - [ ] All existing actor YAML parsing tests continue to pass - [ ] New BDD scenarios cover the injection attack vector and the validation logic - [ ] All nox stages pass - [ ] Coverage ≥ 97% ## Metadata - **Branch**: `bugfix/m3-actor-config-env-var-default-injection` - **Commit Message**: `fix(actors): validate env var default values in ActorConfiguration to prevent injection` - **Milestone**: v3.2.0 - **Parent Epic**: #400 ## Subtasks - [ ] Audit `_interpolate_env_vars` and `replace_env_var` in `src/cleveragents/actor/config.py` for all code paths that return default values - [ ] Define and implement a `_validate_env_var_default(value: str) -> None` helper that raises `ValueError` on dangerous patterns - [ ] Apply validation in `replace_env_var` before returning any default value - [ ] Write BDD scenarios (Behave) covering: shell metacharacter injection, path traversal, valid defaults, missing var with no default - [ ] Write Robot Framework integration test confirming actor YAML with malicious default is rejected at load time - [ ] Run `nox` and confirm all stages pass with coverage ≥ 97% ## Definition of Done - [ ] `_validate_env_var_default` helper implemented and applied in `replace_env_var` - [ ] Shell metacharacters and path traversal sequences in default values raise `ValueError` - [ ] Valid default values (booleans, integers, simple strings) continue to work - [ ] BDD scenarios added covering injection attack vector - [ ] Robot Framework integration test added - [ ] All nox stages pass - [ ] Coverage ≥ 97% > **Note (Bug Fix Workflow):** Per CONTRIBUTING.md, this `Type/Bug` issue requires a companion `Type/Testing` TDD issue (prefixed `TDD:`) that writes a `@tdd_expected_fail` scenario capturing the vulnerability before the fix is implemented. The TDD issue must be created and merged first; this bug fix issue depends on it. --- **Automated by CleverAgents Bot** Supervisor: Acting on behalf of: UAT Testing | Agent: new-issue-creator

HAL9000 added this to the v3.2.0 milestone

2026-04-10 07:27:41 +00:00

HAL9000 added the

State

Unverified

label

2026-04-10 07:30:06 +00:00

HAL9000 added a new dependency

2026-04-10 07:30:32 +00:00

#400 Epic: Post-MVP Security

HAL9000 referenced this issue

2026-04-10 07:30:47 +00:00

[AUTO-BUG-POOL] Status: Bug Detection Report (Cycle 2) #7023

HAL9000 referenced this issue

2026-04-10 08:34:09 +00:00

feat(estimation): build historical plan statistics query service for estimation context assembly #1295

freemo added the

labels

2026-04-12 18:37:36 +00:00

HAL9000 added

and removed

labels

2026-04-14 06:54:52 +00:00

HAL9000 commented

2026-04-14 06:54:52 +00:00

Author

Owner

✅ Verified — Critical security bug: environment variable injection in ActorConfiguration. MoSCoW: Must-have. Priority: Critical.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — Critical security bug: environment variable injection in ActorConfiguration. MoSCoW: Must-have. Priority: Critical. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor