From ece874a8ed0cab95d45635f630e0a74674f7063e Mon Sep 17 00:00:00 2001 From: David Gwilliam Date: Fri, 29 May 2026 20:17:20 -0700 Subject: [PATCH] fix: monitor-agent.py parse board-config.sh safely Replace exec() on shell scripts with regex line parsing to avoid shell injection and only extract PORT from board-config.sh --- scripts/monitor-agent.py | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/scripts/monitor-agent.py b/scripts/monitor-agent.py index f172f9b..e2b8cd4 100644 --- a/scripts/monitor-agent.py +++ b/scripts/monitor-agent.py @@ -8,11 +8,22 @@ import time import threading import serial import select +import re BOARD = sys.argv[1] if len(sys.argv) > 1 else "esp32-32e-4" -# Load board config -exec(open(f"./boards/{BOARD}/board-config.sh").read().replace("export ", "")) +# Load board config - parse shell script format +board_config_path = f"./boards/{BOARD}/board-config.sh" +PORT = "/dev/ttyACM0" # Default +try: + with open(board_config_path, 'r') as f: + for line in f: + line = line.strip() + if line.startswith('PORT='): + PORT = line.split('=', 1)[1].strip() + break +except FileNotFoundError: + print(f"Warning: Board config not found: {board_config_path}") SERIAL_PORT = os.environ.get("PORT", PORT) LOGFILE = f"/tmp/doorbell-{BOARD}.jsonl"