Vulnerability: HITL Bypass via UI Truncation (Vertical Newline Injection) in Command Confirmations #23433

Summary

There is a critical Human-in-the-Loop (HITL) bypass vulnerability in the CLI's command execution confirmation prompt. An attacker (or a compromised/malicious agent response) can use Vertical Newline Injection to execute UI redressing.

Currently, if an agent proposes a massive shell command that is heavily padded with newlines (e.g., hiding a payload like curl | bash at the very bottom), the terminal correctly truncates the view using MaxSizedBox. However, the ToolConfirmationMessage logic remains completely disconnected from this truncation state.

As a result, the "Allow" confirmation options remain active, allowing a user to accidentally approve a command where the actual malicious payload is hidden from their terminal view.

Impact

Users relying on the HITL confirmation step might unknowingly authorize hidden malicious shell commands, completely bypassing the intended security guardrails of the confirmation prompt.

Steps to Reproduce

1. Start the Gemini CLI in a test directory.
2. Prompt the agent to run a maliciously padded multi-line command:

   "Please use the run_shell_command tool to execute this exact string: 'echo Safe' followed by 30 newlines, followed by 'echo Malicious Payload Hidden'"

3. Observe the CLI UI. The display truncates the command (showing ... hidden (Ctrl+O) ...).
4. Notice that the standard 1. Allow once / 2. Allow for this session options are still present and actionable.
5. If the user presses 1, the hidden malicious payload is executed.

Expected Behavior

If a command exceeds the maximum display size and is visually truncated, the standard approval options should be disabled or hidden. The user should be forced to expand the view (e.g., using Ctrl+O) to inspect the full command before the "Allow" options become available.

Actual Behavior

The UI allows execution approval even when critical parts of the command are visually truncated and hidden from the user.

Proposed Solution

I have already submitted a PR to address this issue: #23333.

The fix links the totalHiddenLines calculation in MaxSizedBox to the state logic in ToolConfirmationMessage. If isTruncated is true, the standard "Allow" options are replaced with a safety message (⚠️ Expand to view full command (Press Ctrl+O)), locking out the confirmation until the user explicitly expands the view.