Fix command injection warning in ai/context.py

Use shlex.split() to safely parse bitcoincli path before passing
to subprocess.run(), same pattern as clock/data.py fix.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
GaltRanch 2026-04-02 11:40:09 -03:00
parent b556909d87
commit 524e4c9799

View file

@ -1,6 +1,7 @@
"""Gather Bitcoin/Lightning node data for AI context injection."""
import json
import shlex
import subprocess
import requests
@ -32,10 +33,10 @@ def gather_node_context(path, lndconnectload=None):
def _bitcoin_cli_context(path):
"""Gather context via bitcoin-cli."""
ctx = {}
cli = path["bitcoincli"]
cli = shlex.split(path["bitcoincli"])
try:
raw = subprocess.run(
[cli, "getblockchaininfo"],
cli + ["getblockchaininfo"],
capture_output=True, text=True, timeout=10
).stdout
info = json.loads(raw)
@ -52,7 +53,7 @@ def _bitcoin_cli_context(path):
try:
raw = subprocess.run(
[cli, "getmempoolinfo"],
cli + ["getmempoolinfo"],
capture_output=True, text=True, timeout=10
).stdout
mempool = json.loads(raw)
@ -63,7 +64,7 @@ def _bitcoin_cli_context(path):
try:
raw = subprocess.run(
[cli, "getnetworkinfo"],
cli + ["getnetworkinfo"],
capture_output=True, text=True, timeout=10
).stdout
net = json.loads(raw)