-
Notifications
You must be signed in to change notification settings - Fork 757
Open
Labels
Description
Describe the bug
When using copilot with the -p option, the current directory isn't checked against the allowed directories.
This seems like a big problem because one accidental invocation in the wrong place (like $HOME) potentially exposes a lot of private information with no confirmation to allow one to realize the mistake.
Affected version
0.0.365 Commit: 76d0881
Steps to reproduce the behavior
- Create a test directory where Copilot doesn't have access to it or any parents already.
mkdir test - Change the current directory to the test directory.
cd test - Make a test file with potentially private content.
echo "Private data!" > data.txt - Check if Copilot can read the content.
copilot -p "What are the files and their contents in the current directory?"
Expected behavior
Copilot should error in some way since the current directory was never approved for access.
Additional context
As an aside, my output of the above command shows a misleading number of files found and lines read. Not sure what that's about.