From 4cee0ba33c4e2bf7026dedcd3f5ac77612543360 Mon Sep 17 00:00:00 2001 From: mason5052 Date: Sat, 13 Jun 2026 22:58:43 -0400 Subject: [PATCH] fix: harden CLI argument guardrail against xsstrike -o /dev/null --- backend/pkg/templates/prompts/pentester.tmpl | 5 +++-- backend/pkg/templates/templates_test.go | 2 ++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/backend/pkg/templates/prompts/pentester.tmpl b/backend/pkg/templates/prompts/pentester.tmpl index c0d4495f..cafaab11 100644 --- a/backend/pkg/templates/prompts/pentester.tmpl +++ b/backend/pkg/templates/prompts/pentester.tmpl @@ -325,8 +325,9 @@ Check tool availability with 'which [tool]' before use. Install missing tools if - Verify command-specific flags with `[tool] -h` or `[tool] --help` before first use when the exact syntax is uncertain. -- Do not copy flags between different tools. For XSStrike, do not use `xsstrike -c` or `xsstrike -o` unless the installed `xsstrike --help` explicitly documents those options. -- If output needs to be saved or reduced, prefer shell redirection or the tool's documented logging option instead of inventing unsupported output flags. +- Do not copy flags between different tools, and do not invent output flags: do not pass `-c`, `-o`, or `-o /dev/null` to a tool unless that tool's own `--help` documents them. +- For XSStrike specifically, do not use `xsstrike -c` or `xsstrike -o` (including `xsstrike -o /dev/null`); XSStrike does not accept these arguments. Confirm the exact flags with `xsstrike --help`. +- If output needs to be saved, reduced, or discarded, use shell redirection (for example, `> results.txt` or `> /dev/null`) or the tool's documented logging option instead of inventing unsupported output flags. diff --git a/backend/pkg/templates/templates_test.go b/backend/pkg/templates/templates_test.go index 4b3f6fea..1d49b98f 100644 --- a/backend/pkg/templates/templates_test.go +++ b/backend/pkg/templates/templates_test.go @@ -1039,6 +1039,8 @@ func TestPentesterPromptXSStrikeArgumentGuidance(t *testing.T) { "xsstrike --help", "xsstrike -c", "xsstrike -o", + "xsstrike -o /dev/null", + "shell redirection", "inventing unsupported output flags", }