fix(core): remove shell outputChunks buffer caching to prevent memory bloat and sanitize prompt input#23751
Conversation
|
Hi @spencer426, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this. We're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: Improving Our Contribution Process & Introducing New Guidelines. Key Update: Starting January 26, 2026, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed. Thank you for your understanding and for being a part of our community! |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request implements a crucial performance enhancement by refactoring the shell execution service to stream command output rather than accumulating it in memory. This change directly tackles memory bloat, which previously led to system crashes and degraded user interface responsiveness under heavy load. By no longer retaining large raw output buffers, the system's resource utilization is significantly reduced, leading to a more stable and efficient user experience. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
|
Size Change: +454 B (0%) Total Size: 26.3 MB
ℹ️ View Unchanged
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request aims to mitigate memory bloat by making rawOutput optional in ExecutionResult and modifying shellExecutionService.ts to no longer store the full raw output buffer. However, the review identifies that the core issue of unbounded buffer growth persists in shellExecutionService.ts for both child_process fallback and PTY execution paths, leading to potential Denial of Service vulnerabilities due to memory exhaustion. Additionally, a security vulnerability related to Indirect Prompt Injection via command output was identified in shellCommandProcessor.ts, where the binary stream detection mechanism is insufficient, allowing malicious output to bypass sanitization and inject instructions into the LLM's context.
gemini-cli
bot
added
status/need-issue
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
spencer426
force-pushed
the
23290-disk-backed-shell-execution
branch
2 times, most recently
from
8af7270 to
09de738
Compare
spencer426
force-pushed
the
23290-disk-backed-shell-execution
branch
from
03f022a to
2a57215
Compare
spencer426
changed the title
… bloat and sanitize prompt input (#23751)
… bloat and sanitize prompt input (google-gemini#23751)
… bloat and sanitize prompt input (google-gemini#23751)
3 participants
Summary
Fixes a memory bloat issue where output chunks from
child_processandnode-ptyexecutions were being held in memory and appended into unbounded arrays. This also resolves an indirect prompt injection vulnerability identified by CodeQL when inserting shell output containing markdown backticks into the LLM context window.Details
1. Memory Bloat Mitigation:
Stops collecting chunks in the backend
outputChunksarray inShellExecutionService. Instead of storing the full execution history indefinitely, it implements a constrainedsniffChunksarray (max 4096 bytes) used strictly for encoding detection. Real-time terminal progress is now tracked mathematically via abinaryBytesReceivedcounter instead of caching memory. Additionally, the maximum UI string concatenation lengths have been hardcapped to 1MB.2. Prompt Injection Fix:
Implements a strict, multi-pass regex replacement (
.replace(/\\/g, '\\\\').replace(/\/g, '\`')) withinaddShellCommandToGeminiHistoryto guarantee that malicious strings containing escape slashes or backticks cannot break out of the intended \``sh context blocks when passed to the model.Related Issues
Fixes #23290
How to Validate
Pre-Merge Checklist