提出 #856882: princezuda safestclaw 4.2.4 Incomplete List of Disallowed Inputs (CWE-184)

# Technical Details
A shell allowlist bypass exists in the `ShellAction._validate_command()` method in `src/safestclaw/actions/shell.py` of safestclaw.

The application tokenizes the user-supplied command with `shlex.split()` and validates only the basename of `args[0]`. Because `env` is in `DEFAULT_ALLOWED`, a command such as `env bash -c id` passes validation even though `bash` is not allowlisted. The code never inspects or re-binds policy to the effective inner executable, so `ShellAction.execute()` passes the full attacker-controlled argv to `asyncio.create_subprocess_exec(*args)`.

# Vulnerable Code
File: src/safestclaw/actions/shell.py
Method: _validate_command()
Why: The method validates only `Path(args[0]).name` against the allowlist, so `env bash -c id` is approved based on `env` alone. The effective inner executable (`bash`) is never checked.

# Reproduction
1. Start the SafeClaw web server on the 4.2.4 release.
2. Send `POST /api/message {"text":"shell env bash -c id"}` to the built-in web interface.
3. Observe the response returns `uid=0(root) gid=0(root) groups=0(root)`.
4. Send the control command `POST /api/message {"text":"shell bash -c id"}`.
5. Observe the control returns `Command blocked: Command not allowed: bash`.

# Impact
- Bypasses the built-in shell executable allowlist.
- Attackers can execute denied interpreters by wrapping them with `env`.
- Code runs with SafeClaw process privileges, granting access to files, environment variables, and network resources.

• ソース: ⚠️ https://github.com/princezuda/safestclaw/issues/59
• ユーザー: Eric-x (UID 94869)
• 送信: 2026年06月12日 11:52 (1 月 ago)
• モデレーション: 2026年07月17日 18:13 (1 month later)
• ステータス: 承諾済み
• VulDBエントリ: 379845 [princezuda SafestClaw 迄 4.2.4 Built-in Web Interface shell.py ShellAction._validate_command 特権昇格]
• ポイント: 20