Andy
750ea8d188
* fix(security): inherit security profiles in worktrees and validate shell -c commands - Add inherited_from field to SecurityProfile to mark profiles copied from parent projects - Skip hash-based re-analysis for inherited profiles (fixes worktrees losing npm/npx etc.) - Add shell_validators.py to validate commands inside bash/sh/zsh -c strings - Register shell validators to close security bypass via bash -c "arbitrary_command" - Add 13 new tests for inherited profiles and shell -c validation Fixes worktree security config not being inherited, which caused agents to be blocked from running npm/npx commands in isolated workspaces. * docs: update README download links to v2.7.3 (#976) - Update all stable download links from 2.7.2 to 2.7.3 - Add Flatpak download link (new in 2.7.3) * fix(security): close shell -c bypass vectors and validate inherited profiles - Fix combined shell flags bypass (-xc, -ec, -ic) in _extract_c_argument() Shell allows combining flags like `bash -xc 'cmd'` which bypassed -c detection - Add recursive validation for nested shell invocations Prevents bypass via `bash -c "bash -c 'evil_cmd'"` - Validate inherited_from path in should_reanalyze() with defense-in-depth - Must exist and be a directory - Must be an ancestor of current project - Must contain valid security profile - Add comprehensive test coverage for all security fixes Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * style: fix import ordering in test_security.py Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * style: format shell_validators.py Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
89 lines
2.5 KiB
Python
89 lines
2.5 KiB
Python
"""
|
|
Command Validators
|
|
==================
|
|
|
|
Entry point for command validation. This module provides a unified interface
|
|
to all specialized validators.
|
|
|
|
The validation logic is organized into separate modules:
|
|
- validation_models.py: Type definitions and common types
|
|
- process_validators.py: Process management (pkill, kill, killall)
|
|
- filesystem_validators.py: File system operations (chmod, rm, init.sh)
|
|
- git_validators.py: Git operations (commit with secret scanning)
|
|
- database_validators.py: Database operations (postgres, mysql, redis, mongo)
|
|
- validator_registry.py: Central registry of all validators
|
|
|
|
For backwards compatibility, all validators and the VALIDATORS registry
|
|
are re-exported from this module.
|
|
"""
|
|
|
|
# Re-export validation models
|
|
# Re-export all validators for backwards compatibility
|
|
from .database_validators import (
|
|
validate_dropdb_command,
|
|
validate_dropuser_command,
|
|
validate_mongosh_command,
|
|
validate_mysql_command,
|
|
validate_mysqladmin_command,
|
|
validate_psql_command,
|
|
validate_redis_cli_command,
|
|
)
|
|
from .filesystem_validators import (
|
|
validate_chmod_command,
|
|
validate_init_script,
|
|
validate_rm_command,
|
|
)
|
|
from .git_validators import (
|
|
validate_git_command,
|
|
validate_git_commit,
|
|
validate_git_config,
|
|
)
|
|
from .process_validators import (
|
|
validate_kill_command,
|
|
validate_killall_command,
|
|
validate_pkill_command,
|
|
)
|
|
from .shell_validators import (
|
|
validate_bash_command,
|
|
validate_sh_command,
|
|
validate_shell_c_command,
|
|
validate_zsh_command,
|
|
)
|
|
from .validation_models import ValidationResult, ValidatorFunction
|
|
from .validator_registry import VALIDATORS, get_validator
|
|
|
|
# Define __all__ for explicit exports
|
|
__all__ = [
|
|
# Types
|
|
"ValidationResult",
|
|
"ValidatorFunction",
|
|
# Registry
|
|
"VALIDATORS",
|
|
"get_validator",
|
|
# Process validators
|
|
"validate_pkill_command",
|
|
"validate_kill_command",
|
|
"validate_killall_command",
|
|
# Filesystem validators
|
|
"validate_chmod_command",
|
|
"validate_rm_command",
|
|
"validate_init_script",
|
|
# Git validators
|
|
"validate_git_commit",
|
|
"validate_git_command",
|
|
"validate_git_config",
|
|
# Shell validators
|
|
"validate_shell_c_command",
|
|
"validate_bash_command",
|
|
"validate_sh_command",
|
|
"validate_zsh_command",
|
|
# Database validators
|
|
"validate_dropdb_command",
|
|
"validate_dropuser_command",
|
|
"validate_psql_command",
|
|
"validate_mysql_command",
|
|
"validate_mysqladmin_command",
|
|
"validate_redis_cli_command",
|
|
"validate_mongosh_command",
|
|
]
|