🔒 security fix for PowerShell command injection by badMade · Pull Request #117 · badMade/claw-code

badMade · 2026-05-02T12:41:21Z

🎯 What: Fixed a potential command injection vulnerability in PowerShell execution.
⚠️ Risk: Direct injection of user input into a shell execution via command arguments is a well-known vulnerability that could allow arbitrary command execution.
🛡️ Solution: Replaced the -Command flag with -EncodedCommand. The command string is now UTF-16LE and Base64 encoded before being passed to PowerShell, which is the recommended secure way to pass complex commands and avoid injection or quoting issues.

PR created automatically by Jules for task 12627724688630408301 started by @badMade

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

google-labs-jules · 2026-05-02T12:41:22Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

Copilot

Pull request overview

This PR updates the Rust tools crate's PowerShell execution path to pass commands via PowerShell's -EncodedCommand flag instead of -Command, aiming to change how script text is delivered to the shell.

Changes:

Added the base64 dependency to the tools crate.
Converted PowerShell command strings to UTF-16LE bytes and Base64 before execution.
Replaced -Command with -EncodedCommand for both foreground and background PowerShell invocations.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`rust/crates/tools/src/lib.rs`	Encodes PowerShell command text and switches process invocation to `-EncodedCommand`.
`rust/crates/tools/Cargo.toml`	Adds the `base64` crate needed for command encoding.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+            .arg("-EncodedCommand")
+            .arg(encoded_command)


+        .arg("-EncodedCommand")
+        .arg(encoded_command);


gemini-code-assist

Code Review

This pull request introduces Base64 encoding for shell commands to improve reliability when executing complex strings. It adds the base64 dependency and updates the execute_shell_command function to convert commands to UTF-16 LE before encoding them and passing them via the -EncodedCommand flag. A suggestion was made to pass a reference to the byte vector during encoding to follow idiomatic Rust practices and avoid potential ownership issues.

gemini-code-assist · 2026-05-02T12:47:04Z

+        .encode_utf16()
+        .flat_map(|u| u.to_le_bytes())
+        .collect();
+    let encoded_command = base64::engine::general_purpose::STANDARD.encode(utf16_bytes);


The encoded_command is used in two different code paths (background and foreground execution). Since base64::Engine::encode returns a String, passing it by value to .arg() in the background path (line 5179) would move it, making it unavailable for the foreground path (line 5208). Although the background path returns early, it is safer and more idiomatic to pass a reference to .arg() to avoid potential ownership issues if the code is refactored in the future.

Suggested change

let encoded_command = base64::engine::general_purpose::STANDARD.encode(utf16_bytes);

let encoded_command = base64::engine::general_purpose::STANDARD.encode(&utf16_bytes);

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+        .arg("-EncodedCommand")
+        .arg(encoded_command);


+        assert_eq!(
+            output["stdout"],
+            "pwsh:VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIABoAGUAbABsAG8A"
+        );


badMade · 2026-05-02T18:44:46Z

@claude code review
@codex code review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8da56aabb2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-02T18:47:59Z

+    let utf16_bytes: Vec<u8> = command
+        .encode_utf16()
+        .flat_map(|u| u.to_le_bytes())
+        .collect();
+    let encoded_command = base64::engine::general_purpose::STANDARD.encode(utf16_bytes);


Avoid expanding PowerShell payload past Windows argv limit

Switching from -Command to -EncodedCommand base64-expands every script (UTF-16LE + base64), which reduces the maximum runnable command size on Windows before process creation fails with command-line length errors. A command that previously fit as plain text can now exceed the CreateProcess argument limit once encoded, so large generated scripts will fail to execute even though they worked before this change.

Useful? React with 👍 / 👎.

@codex, make changes based on:

Avoid expanding PowerShell payload past Windows argv limit

Switching from -Command to -EncodedCommand base64-expands every script (UTF-16LE + base64), which reduces the maximum runnable command size on Windows before process creation fails with command-line length errors. A command that previously fit as plain text can now exceed the CreateProcess argument limit once encoded, so large generated scripts will fail to execute even though they worked before this change.

Useful? React with 👍 / 👎.

You have reached your Codex usage limits. You can see your limits in the Codex usage dashboard.

gemini-code-assist · 2026-05-02T18:49:00Z

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

badMade · 2026-05-03T02:04:08Z

@gemini-code-assist, what are the steps and line numbers to make this fix?

gemini-code-assist · 2026-05-03T02:04:11Z

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

fix: use -EncodedCommand for PowerShell execution to prevent injection

6f3d528

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 2, 2026 12:41

Copilot started reviewing on behalf of badMade May 2, 2026 12:41 View session

Copilot AI reviewed May 2, 2026

View reviewed changes

Comment thread rust/crates/tools/src/lib.rs

Comment on lines +5178 to +5179

.arg("-EncodedCommand")

.arg(encoded_command)

Comment thread rust/crates/tools/src/lib.rs

Comment on lines +5207 to +5208

.arg("-EncodedCommand")

.arg(encoded_command);

gemini-code-assist Bot reviewed May 2, 2026

View reviewed changes

badMade and others added 2 commits May 2, 2026 13:37

fix: use -EncodedCommand for PowerShell and update tests

7c9a61f

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

fix: use -EncodedCommand for PowerShell and fix formatting

8da56aa

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 2, 2026 13:51

Copilot started reviewing on behalf of badMade May 2, 2026 13:52 View session

Copilot AI reviewed May 2, 2026

View reviewed changes

Comment thread rust/crates/tools/src/lib.rs

Comment on lines +5207 to +5208

.arg("-EncodedCommand")

.arg(encoded_command);

Comment thread rust/crates/tools/src/lib.rs

Comment on lines +8206 to +8209

assert_eq!(

output["stdout"],

"pwsh:VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIABoAGUAbABsAG8A"

);

chatgpt-codex-connector Bot reviewed May 2, 2026

View reviewed changes

badMade marked this pull request as ready for review May 2, 2026 18:48

	let encoded_command = base64::engine::general_purpose::STANDARD.encode(utf16_bytes);
	let encoded_command = base64::engine::general_purpose::STANDARD.encode(&utf16_bytes);

Conversation

badMade commented May 2, 2026

Uh oh!

google-labs-jules Bot commented May 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

badMade commented May 2, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 2, 2026

Choose a reason for hiding this comment

Uh oh!

badMade May 3, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 3, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot commented May 2, 2026

Uh oh!

badMade commented May 3, 2026

Uh oh!

gemini-code-assist Bot commented May 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants