wololo!

[sl0thentr0py]

HACKWEEK DO NOT MERGE

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 92d3964. Configure here.}

[sentry-warden]

Untrusted LLM patch output is evaluated as Ruby, enabling RCE

When Wololo is enabled, the remote LLM response is treated as Ruby source and evaluated in TOPLEVEL_BINDING without enforcing that it contains only method definitions. A response containing one valid method plus a top-level operation such as system, file access, or network access can therefore execute arbitrary code in the application process; request-controlled exception data is included in the LLM prompt and can enable prompt injection.

Evidence

• Request exceptions captured by the Rack integration reach Hub#capture_exception, which calls Sentry.wololo&.record(exception) when the opt-in worker is enabled.
• Wololo#request_patch embeds the exception message, backtrace, and source files in a prompt and accepts the remote chat.ask response as patch data.
• apply_patches checks syntax, safe file paths, loaded targets, source locations, and a small forbidden method-name list, but does not enforce an AST-level method-only structure. A patch such as def existing; end\nsystem('...') can satisfy the target/source checks.
• apply_prepend_patch interpolates that source into TOPLEVEL_BINDING.eval("Module.new {\n#{source}\n}", ...), executing the top-level operation immediately in the application process before prepending the module.

Also found at 4 additional locations

• sentry-ruby/lib/sentry/hub.rb:174-174
• sentry-ruby/lib/sentry/wololo.rb:91-99
• sentry-ruby/lib/sentry/wololo.rb:386-388
• sentry-ruby/lib/sentry/wololo.rb:426-501

_{Identified by Warden · security-review · NWG-8RS}

[sentry-warden]

Opt-in Wololo sends unredacted application source and exception data to OpenRouter

When an application enables config.wololo and supplies an OpenRouter key, captured exceptions with in-app frames cause Wololo to send exception messages, backtraces, and up to 200 KB of local application source to OpenRouter. Source files and exception data may contain credentials or PII, and the request has no redaction or configurable filtering before crossing the application’s data boundary.

Evidence

• Sentry::Hub#capture_exception calls Sentry.wololo&.record(exception) before normal event filtering, so captured exceptions—including messages containing caller-controlled request data—can enter the Wololo queue.
• Wololo#issue_from and source_files collect the exception class, message, backtrace, and up to 10 source files under the configured project root and application directories, with a 200 KB total limit but no secret filtering.
• Wololo#request_patch embeds those values in the prompt and sends it through RubyLLM.chat(provider: "openrouter").ask(prompt) using the configured OpenRouter API key.
• Wololo is disabled by default, but enabling it is the explicit security boundary; the effective path contains no redaction or consent-specific data controls beyond that opt-in.

_{Identified by Warden · security-review · NKH-YZD}