github / github/copilot-cli

Prompt mode `-p` doesn't respect allowed directories

Open
#668 0 comments 0 reactions 0 assignees View on GitHub
area:non-interactive area:permissions
Dominant language
Shell
Stars
11.2k
Forks
1.9k
Avg merge
14h 16m
Merged PRs (30d)
6

Description

### Describe the bug

When using `copilot` with the `-p` option, the current directory isn't checked against the allowed directories.

This seems like a big problem because one accidental invocation in the wrong place (like `$HOME`) potentially exposes a lot of private information with no confirmation to allow one to realize the mistake.

### Affected version

0.0.365 Commit: 76d0881

### Steps to reproduce the behavior

1. Create a test directory where Copilot doesn't have access to it or any parents already.
`mkdir test`
2. Change the current directory to the test directory.
`cd test`
3. Make a test file with potentially private content.
`echo "Private data!" > data.txt`
4. Check if Copilot can read the content.
`copilot -p "What are the files and their contents in the current directory?"`

### Expected behavior

Copilot should error in some way since the current directory was never approved for access.

### Additional context

As an aside, my output of the above command shows a misleading number of files found and lines read. Not sure what that's about.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.