Restructure dash (#372)
* Restructure dash * WIP * WIP * refactor trigger UI: extract PR summary card, add mentions section, rename labels Co-authored-by: Cursor <cursoragent@cursor.com> * clean up console UI: remove info icons from section descriptions, rename mentions trigger Co-authored-by: Cursor <cursoragent@cursor.com> * fix review feedback: layout, terminology, form scope - extract console sidebar sections to module-level constant - align three-column layout breakpoints to xl (match sidebar visibility) - fix mixed shell/bash terminology in beta page - scope FormProvider to trigger sections only, restore autoComplete="off" Co-authored-by: Cursor <cursoragent@cursor.com> * Bump --------- Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
committed by
pullfrog[bot]
parent
b8a0d799ee
commit
a7bd746f21
@@ -110,7 +110,7 @@ export const installNodeDependencies: PrepDefinition = {
|
||||
|
||||
// check if package manager is available, install if needed
|
||||
if (!(await isCommandAvailable(packageManager))) {
|
||||
// SECURITY: when bash is disabled, don't install package managers.
|
||||
// SECURITY: when shell is disabled, don't install package managers.
|
||||
// installPackageManager runs `npm install -g` or `curl | sh` (for deno),
|
||||
// both of which execute code. the package manager must already be available.
|
||||
if (options.ignoreScripts) {
|
||||
@@ -119,7 +119,7 @@ export const installNodeDependencies: PrepDefinition = {
|
||||
packageManager,
|
||||
dependenciesInstalled: false,
|
||||
issues: [
|
||||
`${packageManager} is not available and cannot be installed when bash is disabled (would execute code)`,
|
||||
`${packageManager} is not available and cannot be installed when shell is disabled (would execute code)`,
|
||||
],
|
||||
};
|
||||
}
|
||||
@@ -146,11 +146,11 @@ export const installNodeDependencies: PrepDefinition = {
|
||||
};
|
||||
}
|
||||
|
||||
// SECURITY: when bash is disabled, suppress lifecycle scripts to prevent
|
||||
// SECURITY: when shell is disabled, suppress lifecycle scripts to prevent
|
||||
// agents from injecting arbitrary code execution via package.json scripts
|
||||
if (options.ignoreScripts) {
|
||||
resolved.args.push("--ignore-scripts");
|
||||
log.info("» --ignore-scripts enabled (bash disabled)");
|
||||
log.info("» --ignore-scripts enabled (shell disabled)");
|
||||
}
|
||||
|
||||
const fullCommand = `${resolved.command} ${resolved.args.join(" ")}`;
|
||||
|
||||
@@ -120,7 +120,7 @@ export const installPythonDependencies: PrepDefinition = {
|
||||
|
||||
log.info(`» detected python config: ${config.file} (using ${config.tool})`);
|
||||
|
||||
// SECURITY: when bash is disabled, skip ALL python dependency installation.
|
||||
// SECURITY: when shell is disabled, skip ALL python dependency installation.
|
||||
// every python install path can potentially execute arbitrary code:
|
||||
// - setup.py / pyproject.toml: directly execute build backends
|
||||
// - requirements.txt: can contain "-e ." or local path references that
|
||||
@@ -131,7 +131,7 @@ export const installPythonDependencies: PrepDefinition = {
|
||||
// there is no equivalent of npm's --ignore-scripts for pip.
|
||||
if (options.ignoreScripts) {
|
||||
log.info(
|
||||
`» skipping python install (bash disabled, python packages can execute arbitrary code)`
|
||||
`» skipping python install (shell disabled, python packages can execute arbitrary code)`
|
||||
);
|
||||
return {
|
||||
language: "python",
|
||||
@@ -139,7 +139,7 @@ export const installPythonDependencies: PrepDefinition = {
|
||||
configFile: config.file,
|
||||
dependenciesInstalled: false,
|
||||
issues: [
|
||||
`skipped: python dependency installation can execute arbitrary code (setup.py, build backends, local path references), which is blocked when bash is disabled`,
|
||||
`skipped: python dependency installation can execute arbitrary code (setup.py, build backends, local path references), which is blocked when shell is disabled`,
|
||||
],
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user