From 524e4c9799df1e5f27ec6c5fb4600a2dc096bebb Mon Sep 17 00:00:00 2001 From: GaltRanch Date: Thu, 2 Apr 2026 11:40:09 -0300 Subject: [PATCH] Fix command injection warning in ai/context.py Use shlex.split() to safely parse bitcoincli path before passing to subprocess.run(), same pattern as clock/data.py fix. Co-Authored-By: Claude Opus 4.6 (1M context) --- pybitblock/ai/context.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/pybitblock/ai/context.py b/pybitblock/ai/context.py index 9ef6943..ba002ac 100644 --- a/pybitblock/ai/context.py +++ b/pybitblock/ai/context.py @@ -1,6 +1,7 @@ """Gather Bitcoin/Lightning node data for AI context injection.""" import json +import shlex import subprocess import requests @@ -32,10 +33,10 @@ def gather_node_context(path, lndconnectload=None): def _bitcoin_cli_context(path): """Gather context via bitcoin-cli.""" ctx = {} - cli = path["bitcoincli"] + cli = shlex.split(path["bitcoincli"]) try: raw = subprocess.run( - [cli, "getblockchaininfo"], + cli + ["getblockchaininfo"], capture_output=True, text=True, timeout=10 ).stdout info = json.loads(raw) @@ -52,7 +53,7 @@ def _bitcoin_cli_context(path): try: raw = subprocess.run( - [cli, "getmempoolinfo"], + cli + ["getmempoolinfo"], capture_output=True, text=True, timeout=10 ).stdout mempool = json.loads(raw) @@ -63,7 +64,7 @@ def _bitcoin_cli_context(path): try: raw = subprocess.run( - [cli, "getnetworkinfo"], + cli + ["getnetworkinfo"], capture_output=True, text=True, timeout=10 ).stdout net = json.loads(raw)