{"record":{"id":"9bca8d60f80f8f4f","repo":"FoundationAgents/OpenManus","slug":"command-contains-potentially-dangerous-operation","errorCode":null,"errorMessage":"Command contains potentially dangerous operation: {risky}","messagePattern":"Command contains potentially dangerous operation: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"warning","filePath":"app/sandbox/core/terminal.py","lineNumber":244,"sourceCode":"\n        Raises:\n            ValueError: If command contains potentially dangerous patterns.\n        \"\"\"\n\n        # Additional checks for specific risky commands\n        risky_commands = [\n            \"rm -rf /\",\n            \"rm -rf /*\",\n            \"mkfs\",\n            \"dd if=/dev/zero\",\n            \":(){:|:&};:\",\n            \"chmod -R 777 /\",\n            \"chown -R\",\n        ]\n\n        for risky in risky_commands:\n            if risky in command.lower():\n                raise ValueError(\n                    f\"Command contains potentially dangerous operation: {risky}\"\n                )\n\n        return command\n\n\nclass AsyncDockerizedTerminal:\n    def __init__(\n        self,\n        container: Union[str, Container],\n        working_dir: str = \"/workspace\",\n        env_vars: Optional[Dict[str, str]] = None,\n        default_timeout: int = 60,\n    ) -> None:\n        \"\"\"Initializes an asynchronous terminal for Docker containers.\n\n        Args:\n            container: Docker container ID or Container object.","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/FoundationAgents/OpenManus/blob/52a13f2a57d8c7f6737eefb02ccf569594d44273/app/sandbox/core/terminal.py#L226-L262","documentation":"The command sanitizer in DockerSession rejects commands whose text contains any entry of a hardcoded blocklist ('rm -rf /', 'mkfs', 'dd if=/dev/zero', fork bomb, 'chmod -R 777 /', 'chown -R'). It is a naive substring match on the lowercased command, so it fires on exact patterns and — notably — on ANY recursive chown ('chown -R' is matched without a target), producing false positives for legitimate operations.","triggerScenarios":"Passing any command containing 'chown -R' (e.g. 'chown -R user:user /workspace'), or one of the destructive patterns. Also fires when a benign command merely embeds a blocklisted substring in a string argument or filename.","commonSituations":"Build steps that fix ownership inside the container; docs/scripts quoted inside an echoed string; agent-generated cleanup commands that legitimately match 'rm -rf /some/path' (only 'rm -rf /' and 'rm -rf /*' are blocked, so 'rm -rf /workspace/tmp' is fine, but quoting quirks can still match).","solutions":["Rephrase the blocked operation: use scoped targets ('rm -rf /workspace/build') instead of root-level patterns.","Replace 'chown -R user:user /path' with a non-blocked equivalent (e.g. run as the right user from the start, or 'find /path -exec chown user:user {} +') — or patch the blocklist to match 'chown -R' only with dangerous targets.","Catch ValueError at the call site and report the rejected pattern back to the command source (LLM/agent) so it can rephrase instead of crashing the tool.","Never try to bypass by obfuscation; if the pattern is legitimate, amend the sanitizer's list in your fork with tests."],"exampleFix":"# before\nawait term.execute(\"chown -R appuser:appuser /workspace\")  # ValueError: dangerous operation 'chown -R'\n\n# after\nawait term.execute(\"find /workspace -exec chown appuser:appuser {} +\")\n\n# or narrow the blocklist:\nrisky_commands = [\"rm -rf /\", \"rm -rf /*\", \"mkfs\", \"dd if=/dev/zero\", \":(){:|:&};:\", \"chmod -R 777 /\"]  # drop bare 'chown -R'","handlingStrategy":"validation","validationCode":"BLOCKLIST = ('rm -rf /', 'rm -rf /*', 'mkfs', 'dd if=/dev/zero', ':(){:|:&};:', 'chmod -R 777 /', 'chown -R')\ndef is_sanitized(cmd: str) -> bool:\n    low = cmd.lower()\n    return not any(p in low for p in BLOCKLIST)","typeGuard":null,"tryCatchPattern":"try:\n    out = await term.execute(cmd)\nexcept ValueError as e:\n    if 'potentially dangerous' in str(e):\n        # feed the rejected pattern back to the command source to rephrase\n        cmd = rephrase(cmd, str(e))\n        out = await term.execute(cmd)\n    else:\n        raise","preventionTips":["Scope destructive commands to project paths, never root.","Remember 'chown -R' is blocked wholesale — plan ownership differently.","Keep sanitizer and its test list in sync when you fork."],"tags":["validation","command-injection","blocklist","false-positive"],"backgroundTag":null,"analyzedSha":"52a13f2a57d8c7f6737eefb02ccf569594d44273","analyzedAt":"2026-08-15T02:33:49.993Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}