From 53cdf488b61e2c49a9f13dee89e727dbc92d800e Mon Sep 17 00:00:00 2001 From: Jabber Developer Date: Tue, 19 May 2026 16:42:22 +0000 Subject: [PATCH] fix(ai): resolve UAF and require provider argument instead of defaults This enforces explicit provider specification. Automatic fallback to preferences or "openai" is removed. Users must now pass the provider name explicitly. default provider functionality was improperly removed and implemented (some parts still remain intact), leading to UAF. --- src/command/cmd_funcs.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/src/command/cmd_funcs.c b/src/command/cmd_funcs.c index 2a49415e..c575de6a 100644 --- a/src/command/cmd_funcs.c +++ b/src/command/cmd_funcs.c @@ -10932,21 +10932,14 @@ cmd_ai_start(ProfWin* window, const char* const command, gchar** args) if (g_strv_length(args) >= 2) { provider_name = args[1]; } - if (g_strv_length(args) >= 3) { - model = args[2]; + + if (!provider_name) { + cons_show_error("Please specify provider name."); + return TRUE; } - // Resolve defaults - auto_gchar gchar* owned_provider_name = NULL; - if (!provider_name) { - // Use default provider from preferences - auto_gchar gchar* default_provider = prefs_get_string(PREF_AI_PROVIDER); - if (default_provider && strlen(default_provider) > 0) { - provider_name = default_provider; - } - } - if (!provider_name) { - provider_name = "openai"; // Fallback + if (g_strv_length(args) >= 3) { + model = args[2]; } AIProvider* provider = ai_get_provider(provider_name);