Fix：react shell runtime policy

packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py

@@ -984,6 +984,33 @@ def _sse_event(payload: Dict[str, Any]) -> str:
     return f"data: {json.dumps(payload, ensure_ascii=False)}\n\n"
 
 
+def _normalize_sandbox_execution_status(result: Any):
+    """Normalize execution results returned by local and container runtimes."""
+    from dbgpt_sandbox.sandbox.execution_layer.base import ExecutionStatus
+
+    status = getattr(result, "status", None)
+    if isinstance(status, ExecutionStatus):
+        return status
+    if getattr(result, "exit_code", None) == 124:
+        return ExecutionStatus.TIMEOUT
+    if isinstance(status, str):
+        try:
+            return ExecutionStatus(status.lower())
+        except ValueError:
+            pass
+    return ExecutionStatus.ERROR
+
+
+def _shell_validation_error(code: str) -> Optional[str]:
+    """Return the existing sandbox validation error for unsafe shell code."""
+    from dbgpt_sandbox.sandbox.execution_layer.utils import SecurityUtils
+
+    warnings = SecurityUtils.validate_code(code, "bash")
+    if warnings and any("危险操作" in warning for warning in warnings):
+        return f"代码安全检查失败: {'; '.join(warnings)}"
+    return None
+
+
 async def _react_agent_stream(
     dialogue: ConversationVo,
 ) -> AsyncGenerator[str, None]:
@@ -2177,8 +2204,8 @@ async def shell_interpreter(code: str) -> str:
                 ExecutionStatus,
                 SessionConfig,
             )
-            from dbgpt_sandbox.sandbox.execution_layer.local_runtime import (
-                LocalRuntime,
+            from dbgpt_sandbox.sandbox.execution_layer.runtime_factory import (
+                RuntimeFactory,
             )
         except ImportError:
             return json.dumps(
@@ -2197,8 +2224,19 @@ async def shell_interpreter(code: str) -> str:
                 ensure_ascii=False,
             )
 
+        validation_error = _shell_validation_error(code)
+        if validation_error:
+            return json.dumps(
+                {
+                    "chunks": [
+                        {"output_type": "code", "content": code.strip()},
+                        {"output_type": "text", "content": validation_error},
+                    ]
+                },
+                ensure_ascii=False,
+            )
+
         session_id = f"bash_{uuid.uuid4().hex[:12]}"
-        runtime = LocalRuntime()
 
         from dbgpt.configs.model_config import ROOT_PATH
 
@@ -2213,13 +2251,16 @@ async def shell_interpreter(code: str) -> str:
         )
 
         output_text = ""
+        runtime = None
         try:
+            runtime = RuntimeFactory.create()
             session = await runtime.create_session(session_id, config)
             result = await session.execute(code)
+            result_status = _normalize_sandbox_execution_status(result)
 
-            if result.status == ExecutionStatus.SUCCESS:
+            if result_status == ExecutionStatus.SUCCESS:
                 output_text = result.output or ""
-            elif result.status == ExecutionStatus.TIMEOUT:
+            elif result_status == ExecutionStatus.TIMEOUT:
                 output_text = f"Execution timed out ({config.timeout}s limit)"
             else:
                 output_text = result.error or "Unknown execution error"
@@ -2228,10 +2269,11 @@ async def shell_interpreter(code: str) -> str:
         except Exception as e:
             output_text = f"Sandbox execution error: {e}"
         finally:
-            try:
-                await runtime.destroy_session(session_id)
-            except Exception:
-                pass
+            if runtime is not None:
+                try:
+                    await runtime.destroy_session(session_id)
+                except Exception:
+                    pass
 
         chunks: List[Dict[str, Any]] = [
             {"output_type": "code", "content": code.strip()},

packages/dbgpt-app/src/dbgpt_app/tests/test_react_shell_runtime.py

@@ -0,0 +1,77 @@
+import ast
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+from dbgpt_app.openapi.api_v1.agentic_data_api import (
+    _normalize_sandbox_execution_status,
+    _shell_validation_error,
+)
+from dbgpt_sandbox.sandbox.execution_layer.base import ExecutionStatus
+
+
+@pytest.mark.parametrize(
+    ("result", "expected"),
+    [
+        (
+            SimpleNamespace(status=ExecutionStatus.SUCCESS, exit_code=0),
+            ExecutionStatus.SUCCESS,
+        ),
+        (
+            SimpleNamespace(status="success", exit_code=0),
+            ExecutionStatus.SUCCESS,
+        ),
+        (
+            SimpleNamespace(status="error", exit_code=124),
+            ExecutionStatus.TIMEOUT,
+        ),
+        (
+            SimpleNamespace(status="error", exit_code=1),
+            ExecutionStatus.ERROR,
+        ),
+        (
+            SimpleNamespace(status="unexpected", exit_code=1),
+            ExecutionStatus.ERROR,
+        ),
+    ],
+)
+def test_normalize_sandbox_execution_status(result, expected):
+    assert _normalize_sandbox_execution_status(result) == expected
+
+
+def test_shell_validation_allows_benign_code():
+    assert _shell_validation_error("printf 'hello\\n'") is None
+
+
+def test_shell_validation_rejects_existing_dangerous_pattern():
+    error = _shell_validation_error("rm -rf /")
+
+    assert error is not None
+    assert "代码安全检查失败" in error
+
+
+def test_shell_interpreter_uses_runtime_factory_and_entry_validation():
+    source_path = (
+        Path(__file__).resolve().parents[1]
+        / "openapi"
+        / "api_v1"
+        / "agentic_data_api.py"
+    )
+    tree = ast.parse(source_path.read_text(encoding="utf-8"))
+    shell_interpreter = next(
+        node
+        for node in ast.walk(tree)
+        if isinstance(node, ast.AsyncFunctionDef)
+        and node.name == "shell_interpreter"
+    )
+
+    call_names = {
+        ast.unparse(node.func)
+        for node in ast.walk(shell_interpreter)
+        if isinstance(node, ast.Call)
+    }
+
+    assert "RuntimeFactory.create" in call_names
+    assert "LocalRuntime" not in call_names
+    assert "_shell_validation_error" in call_names

packages/dbgpt-core/src/dbgpt/agent/core/base_agent.py

@@ -10,7 +10,7 @@
 from datetime import datetime
 from typing import Any, Callable, Dict, List, Optional, Tuple, Type, cast, final
 
-from jinja2 import Template
+from jinja2.sandbox import SandboxedEnvironment
 
 from dbgpt._private.pydantic import ConfigDict, Field
 from dbgpt.core import LLMClient, ModelMessageRoleType, PromptTemplate
@@ -1255,7 +1255,13 @@ def __missing__(self, key):
             if self.bind_prompt.template_format == "f-string":
                 system_prompt = self.bind_prompt.format(**prompt_param)
             elif self.bind_prompt.template_format == "jinja2":
-                system_prompt = Template(self.bind_prompt.template).render(prompt_param)
+                # Render in a sandbox: bind_prompt.template may contain
+                # user-controlled content (e.g. a selected skill's instructions),
+                # so a plain jinja2.Template would allow SSTI -> RCE.
+                _env = SandboxedEnvironment()
+                system_prompt = _env.from_string(self.bind_prompt.template).render(
+                    prompt_param
+                )
             else:
                 logger.warning("Bind prompt template not exsit or  format not support!")
         if not system_prompt:

packages/dbgpt-core/src/dbgpt/agent/core/role.py

@@ -8,7 +8,7 @@
 from enum import Enum
 from typing import TYPE_CHECKING, Dict, List, Optional, Type, Union
 
-from jinja2 import Environment, Template, meta
+from jinja2 import Environment, meta
 from jinja2.sandbox import SandboxedEnvironment
 
 from dbgpt._private.pydantic import BaseModel, ConfigDict, Field
@@ -118,7 +118,9 @@ def prompt_template(
         """Get agent prompt template."""
         self.language = language
         system_prompt = self.current_profile.get_system_prompt_template()
-        template = Template(system_prompt)
+        # Render via the sandboxed environment to prevent SSTI from any
+        # user-controlled content that reaches the system prompt template.
+        template = self.template_env.from_string(system_prompt)
 
         env = Environment()
         parsed_content = env.parse(system_prompt)

packages/dbgpt-core/src/dbgpt/core/interface/prompt.py

@@ -23,16 +23,18 @@
 
 
 def _jinja2_formatter(template: str, **kwargs: Any) -> str:
-    """Format a template using jinja2."""
+    """Format a template using jinja2 in a secure sandbox."""
     try:
-        from jinja2 import Template
+        from jinja2.sandbox import SandboxedEnvironment
     except ImportError:
         raise ImportError(
             "jinja2 not installed, which is needed to use the jinja2_formatter. "
             "Please install it with `pip install jinja2`."
         )
 
-    return Template(template).render(**kwargs)
+    env = SandboxedEnvironment()
+
+    return env.from_string(template).render(**kwargs)
 
 
 _DEFAULT_FORMATTER_MAPPING: Dict[str, Callable] = {

packages/dbgpt-sandbox/src/dbgpt_sandbox/sandbox/config.py

@@ -2,6 +2,7 @@
 
 LANGUAGE_IMAGES = {
     "python": "python:3.11-slim",
+    "bash": "python:3.11-slim",
     "python-vnc": "vnc-gui-browser:latest",
     "javascript": "node:18-slim",
     "java": "openjdk:11-jre-slim",
@@ -22,6 +23,7 @@ def get_command_by_language(language: str, filename: str) -> str:
         "cpp": f"g++ -o program {filename} && ./program",
         "go": f"go run {filename}",
         "rust": f"rustc {filename} -o program && ./program",
+        "bash": f"sh {filename}",
     }
     return commands.get(language, f"cat {filename}")
 

packages/dbgpt-sandbox/src/dbgpt_sandbox/sandbox/execution_layer/docker_runtime.py

@@ -346,6 +346,7 @@ def _create_code_file(self, code: str) -> str:
             "go": ".go",
             "rust": ".rs",
             "python-vnc": ".py",
+            "bash": ".sh",
         }
         ext = extensions.get(self.config.language, ".txt")
         timestamp = int(time.time() * 1000)

packages/dbgpt-sandbox/tests/test_bash_runtime_config.py

@@ -0,0 +1,34 @@
+from pathlib import Path
+
+from dbgpt_sandbox.sandbox.config import (
+    LANGUAGE_IMAGES,
+    get_command_by_language,
+)
+from dbgpt_sandbox.sandbox.execution_layer.base import SessionConfig
+from dbgpt_sandbox.sandbox.execution_layer.docker_runtime import (
+    DockerSandboxSession,
+)
+
+
+def test_bash_reuses_python_slim_image():
+    assert LANGUAGE_IMAGES["bash"] == LANGUAGE_IMAGES["python"]
+
+
+def test_bash_executes_with_posix_shell():
+    assert get_command_by_language("bash", "run.sh") == "sh run.sh"
+
+
+def test_docker_bash_code_uses_shell_extension(tmp_path, monkeypatch):
+    monkeypatch.setattr(
+        "dbgpt_sandbox.sandbox.execution_layer.docker_runtime.tempfile.gettempdir",
+        lambda: str(tmp_path),
+    )
+    session = DockerSandboxSession(
+        "bash-test",
+        SessionConfig(language="bash"),
+        docker_client=None,
+    )
+
+    code_file = Path(session._create_code_file("printf 'hello\\n'"))
+
+    assert code_file.suffix == ".sh"