🛡️ Sentinel: [HIGH] Fix Newline Injection and Symlink Content Leakage by calionauta · Pull Request #98 · calionauta/agent-sync

calionauta · 2026-06-12T04:50:12Z

🛡️ Sentinel: [HIGH] Fix Newline Injection and Symlink Content Leakage

🚨 Severity: HIGH
💡 Vulnerability:

Internal _is_valid_skill_name regex used $ instead of \Z, allowing trailing newlines to bypass validation.
shutil.copytree and shutil.copy2 followed symbolic links by default during the publishing process.
🎯 Impact:
Newline injection could potentially be used for argument injection if the name is passed to shell commands.
Symlink following could leak sensitive files from the host machine into a public repository if a malicious or accidental symlink is present in the source directory.
🔧 Fix:
Replaced $ with \Z in all _is_valid_skill_name regex patterns.
Hardened file copy operations by setting symlinks=True in shutil.copytree and follow_symlinks=False in shutil.copy2.
✅ Verification:
Created a reproduction script that confirmed both vulnerabilities were exploitable before the fix and blocked after.
Ran the full project test suite (551 tests), which all passed.

PR created automatically by Jules for task 1889418769811345917 started by @renatocaliari

🚨 Severity: HIGH 💡 Vulnerability: 1. Internal `_is_valid_skill_name` regex used `$` instead of `\Z`, allowing trailing newlines to bypass validation. 2. `shutil.copytree` and `shutil.copy2` followed symbolic links by default during the publishing process. 🎯 Impact: 1. Newline injection could potentially be used for argument injection if the name is passed to shell commands. 2. Symlink following could leak sensitive files from the host machine into a public repository if a malicious or accidental symlink is present in the source directory. 🔧 Fix: 1. Replaced `$` with `\Z` in all `_is_valid_skill_name` regex patterns. 2. Hardened file copy operations by setting `symlinks=True` in `shutil.copytree` and `follow_symlinks=False` in `shutil.copy2`. ✅ Verification: 1. Created a reproduction script that confirmed both vulnerabilities were exploitable before the fix and blocked after. 2. Ran the full project test suite (551 tests), which all passed. Co-authored-by: renatocaliari <1719651+renatocaliari@users.noreply.github.com>

google-labs-jules · 2026-06-12T04:50:13Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

gemini-code-assist

Code Review

This pull request addresses security and correctness issues by updating regex patterns to use \Z instead of $ to prevent trailing newline bypasses, and by configuring shutil.copytree and shutil.copy2 to avoid following symbolic links (using symlinks=True and follow_symlinks=False respectively). The reviewer pointed out that copying symlinks (either as symlinks or by attempting to recreate them) can still lead to information disclosure, broken links, and Windows compatibility issues. They recommended skipping or ignoring symbolic links entirely during the copy operations instead.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

gemini-code-assist · 2026-06-12T04:51:49Z

+                               symlinks=True,
                               ignore=_ignore_func(*DEFAULT_IGNORE_PATTERNS))


While setting symlinks=True prevents copying the target file's content, copying symbolic links as symlinks into the published repository has several drawbacks:

Information Disclosure: Absolute symlinks (e.g., pointing to /Users/username/projects/...) will be committed to git, leaking your local directory structure and username.

Broken Links: The committed symlinks will be broken and useless for other users cloning the repository.

Windows Compatibility: On Windows, creating symbolic links requires elevated privileges (or Developer Mode). Running this without them will raise a PermissionError or OSError and crash the publish process.

Instead of copying symlinks, we should ignore them entirely during the copy operation.

ignore=lambda p, n: _ignore_func(*DEFAULT_IGNORE_PATTERNS)(p, n) + [name for name in n if Path(p, name).is_symlink()])

gemini-code-assist · 2026-06-12T04:51:49Z

            else:
                dest.parent.mkdir(parents=True, exist_ok=True)
-                shutil.copy2(src_path, dest)
+                shutil.copy2(src_path, dest, follow_symlinks=False)


If src_path is a symbolic link, copying it with follow_symlinks=False will attempt to recreate the symlink in the destination directory, which leaks local absolute paths to git and can fail on Windows due to privilege requirements. We should skip copying symbolic links entirely.

Suggested change

shutil.copy2(src_path, dest, follow_symlinks=False)

if not src_path.is_symlink():

shutil.copy2(src_path, dest)

gemini-code-assist · 2026-06-12T04:51:49Z

+                                               symlinks=True,
                                               ignore=_ignore_func(*DEFAULT_IGNORE_PATTERNS))


Similar to the copy operation above, we should ignore symbolic links entirely to prevent leaking local paths, committing broken links, and causing Windows permission errors.

ignore=lambda p, n: _ignore_func(*DEFAULT_IGNORE_PATTERNS)(p, n) + [name for name in n if Path(p, name).is_symlink()])

gemini-code-assist · 2026-06-12T04:51:49Z

                            else:
                                dest.parent.mkdir(parents=True, exist_ok=True)
-                                shutil.copy2(skill.path, dest)
+                                shutil.copy2(skill.path, dest, follow_symlinks=False)


Skip copying symbolic links to avoid committing broken links and causing Windows permission errors.

Suggested change

shutil.copy2(skill.path, dest, follow_symlinks=False)

if not skill.path.is_symlink():

shutil.copy2(skill.path, dest)

gemini-code-assist · 2026-06-12T04:51:49Z

                if agent:
                    dest = agents_dir / f"{agent_name}.md"
-                    shutil.copy2(Path(agent.path), dest)
+                    shutil.copy2(Path(agent.path), dest, follow_symlinks=False)


Skip copying symbolic links to avoid committing broken links and causing Windows permission errors.

Suggested change

shutil.copy2(Path(agent.path), dest, follow_symlinks=False)

agent_path = Path(agent.path)

if not agent_path.is_symlink():

shutil.copy2(agent_path, dest)

gemini-code-assist · 2026-06-12T04:51:49Z

                safe_name = agent_name.replace("/", "_").replace(" ", "_")
                dest = agents_dir / f"{safe_name}.md"
-                shutil.copy2(Path(agent.path), dest)
+                shutil.copy2(Path(agent.path), dest, follow_symlinks=False)


Skip copying symbolic links to avoid committing broken links and causing Windows permission errors.

Suggested change

shutil.copy2(Path(agent.path), dest, follow_symlinks=False)

agent_path = Path(agent.path)

if not agent_path.is_symlink():

shutil.copy2(agent_path, dest)

gemini-code-assist Bot reviewed Jun 12, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🛡️ Sentinel: [HIGH] Fix Newline Injection and Symlink Content Leakage#98

🛡️ Sentinel: [HIGH] Fix Newline Injection and Symlink Content Leakage#98
calionauta wants to merge 1 commit into
mainfrom
sentinel/fix-security-vulnerabilities-1889418769811345917

calionauta commented Jun 12, 2026

Uh oh!

google-labs-jules Bot commented Jun 12, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		symlinks=True,
		ignore=_ignore_func(*DEFAULT_IGNORE_PATTERNS))

	shutil.copy2(src_path, dest, follow_symlinks=False)
	if not src_path.is_symlink():
	shutil.copy2(src_path, dest)

	shutil.copy2(skill.path, dest, follow_symlinks=False)
	if not skill.path.is_symlink():
	shutil.copy2(skill.path, dest)

-                    shutil.copy2(Path(agent.path), dest, follow_symlinks=False)
+                    agent_path = Path(agent.path)
+                    if not agent_path.is_symlink():
+                        shutil.copy2(agent_path, dest)

Conversation

calionauta commented Jun 12, 2026

Uh oh!

google-labs-jules Bot commented Jun 12, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant