Insecure Tool Use & Function Calls

// Secure: Constrained tool with allowlist
const { DynamicTool } = require('langchain/tools');
const { initializeAgentExecutorWithOptions } = require('langchain/agents');
const { ChatOpenAI } = require('langchain/chat_models/openai');
const { execFile } = require('child_process');
const util = require('util');
const execFilePromise = util.promisify(execFile);
const path = require('path');

// Allowlist of safe commands
const ALLOWED_COMMANDS = {
  'list_files': { cmd: 'ls', allowedArgs: ['-la'] },
  'disk_usage': { cmd: 'df', allowedArgs: ['-h'] },
  'current_date': { cmd: 'date', allowedArgs: [] }
};

const safeTool = new DynamicTool({
  name: 'system_info',
  description: 'Get system information. Available commands: list_files, disk_usage, current_date',
  func: async (input) => {
    // Parse structured input
    let command;
    try {
      command = JSON.parse(input);
    } catch {
      return 'Error: Input must be valid JSON with "action" field';
    }
    
    const allowedCommand = ALLOWED_COMMANDS[command.action];
    if (!allowedCommand) {
      return `Error: Unknown action. Allowed: ${Object.keys(ALLOWED_COMMANDS).join(', ')}`;
    }
    
    try {
      // Use execFile (not exec) - doesn't spawn shell
      const { stdout } = await execFilePromise(
        allowedCommand.cmd,
        allowedCommand.allowedArgs,
        {
          timeout: 5000,
          maxBuffer: 1024 * 100 // 100KB limit
        }
      );
      return stdout;
    } catch (error) {
      return `Error executing command: ${error.message}`;
    }
  }
});

const model = new ChatOpenAI({ temperature: 0 });
const executor = await initializeAgentExecutorWithOptions(
  [safeTool],
  model,
  {
    agentType: 'chat-conversational-react-description',
    maxIterations: 5,
    maxExecutionTime: 30000
  }
);

app.post('/api/agent', async (req, res) => {
  const { message } = req.body;
  
  // Add system message constraining agent behavior
  const constrainedInput = `${message}\n\nIMPORTANT: Only use provided tools with their exact specifications. Never attempt to access sensitive files or run arbitrary commands.`;
  
  try {
    const result = await executor.call({ input: constrainedInput });
    
    // Filter sensitive data from output
    const sanitizedOutput = sanitizeOutput(result.output);
    res.json({ response: sanitizedOutput });
  } catch (error) {
    res.status(500).json({ error: 'Agent execution failed' });
  }
});

function sanitizeOutput(output) {
  // Remove potential secrets from output
  const patterns = [
    /(?:password|secret|key|token)\s*[=:]\s*\S+/gi,
    /[A-Z0-9]{20,}/g  // Potential AWS keys
  ];
  
  let sanitized = output;
  patterns.forEach(pattern => {
    sanitized = sanitized.replace(pattern, '[REDACTED]');
  });
  
  return sanitized;
}