rubik 0.1.0

data/lib/rubik/security/classifier/parsers/powershell.rb

@@ -0,0 +1,185 @@
+# frozen_string_literal: true
+
+require "tree_sitter_language_pack"
+require_relative "../models"
+
+module Rubik
+  module Security
+    module Classifier
+      module Parsers
+        class PowerShell
+          def self.parser
+            Thread.current[:rubik_ts_pwsh_parser] ||= TreeSitterLanguagePack.get_parser("powershell")
+          end
+
+          def self.parse(expression)
+            new.parse(expression)
+          end
+
+          def parse(expression)
+            tree = self.class.parser.parse(expression)
+            warnings = []
+            warnings << "tree-sitter reported a syntax error in expression: #{expression.inspect}" if tree.root_node.has_error
+
+            invocations = walk_node(tree.root_node, expression, context: "toplevel", operator_before: nil)
+            [invocations, warnings]
+          end
+
+          private
+
+          def walk_node(node, expression, context:, operator_before:, pipeline_position: 0, pipeline_length: 1)
+            results = []
+            case node.kind
+            when "program", "statement_list", "script_block", "script_block_body"
+              results.concat(walk_statements(node, expression, context: context))
+            when "pipeline_chain"
+              results.concat(walk_pipeline_chain(node, expression, context: context, operator_before: operator_before))
+            when "command"
+              inv, nested_blocks = extract_command(
+                node, expression, context: context, operator_before: operator_before,
+                                  pipeline_position: pipeline_position, pipeline_length: pipeline_length
+              )
+              results << inv if inv
+              nested_blocks.each do |block|
+                results.concat(walk_node(block, expression, context: "script_block", operator_before: nil))
+              end
+            else
+              node_children(node).each do |child|
+                results.concat(walk_node(
+                                 child, expression, context: context, operator_before: operator_before,
+                                                    pipeline_position: pipeline_position, pipeline_length: pipeline_length
+                               ))
+              end
+            end
+            results
+          end
+
+          def walk_statements(node, expression, context:)
+            results = []
+            op_before = nil
+            node_children(node).each do |child|
+              if [";", "\n"].include?(child.kind) || child.kind == "empty_statement"
+                op_before = ";"
+                next
+              end
+              results.concat(walk_node(child, expression, context: context, operator_before: op_before))
+              op_before = nil
+            end
+            results
+          end
+
+          def walk_pipeline_chain(node, expression, context:, operator_before:)
+            commands = node_children(node).select { |c| c.kind == "command" }
+            pipe_len = [commands.size, 1].max
+            results = []
+            commands.each_with_index do |cmd, i|
+              op = (i.zero? ? operator_before : "|")
+              inv, nested = extract_command(
+                cmd, expression, context: context, operator_before: op,
+                                 pipeline_position: i, pipeline_length: pipe_len
+              )
+              results << inv if inv
+              nested.each do |block|
+                results.concat(walk_node(block, expression, context: "script_block", operator_before: nil))
+              end
+            end
+            results
+          end
+
+          def extract_command(node, expression, context:, operator_before:, pipeline_position:, pipeline_length:)
+            argv = []
+            redirects = []
+            nested_blocks = []
+
+            node_children(node).each do |child|
+              case child.kind
+              when "command_name", "command_invokation_operator"
+                argv << node_text(child, expression)
+              when "command_name_expr"
+                find_nested_blocks(child, nested_blocks)
+                argv << node_text(child, expression) if argv.empty?
+              when "command_elements"
+                parse_command_elements(child, expression, argv, redirects, nested_blocks)
+              end
+            end
+
+            return [nil, nested_blocks] if argv.empty?
+
+            inv = CommandInvocation.new(
+              argv: argv,
+              redirects: redirects,
+              position_in_pipeline: pipeline_position,
+              pipeline_length: pipeline_length,
+              context: context,
+              operator_before: operator_before,
+              is_background: false
+            )
+            [inv, nested_blocks]
+          end
+
+          def parse_command_elements(node, expression, argv, redirects, nested_blocks)
+            node_children(node).each do |elem|
+              case elem.kind
+              when "command_argument_sep"
+                next
+              when "command_parameter"
+                argv << node_raw_text(elem, expression).strip
+              when "redirection"
+                red = parse_redirection(elem, expression)
+                redirects << red if red
+              else
+                text = node_text(elem, expression).strip
+                argv << text unless text.empty?
+                find_nested_blocks(elem, nested_blocks)
+              end
+            end
+          end
+
+          def parse_redirection(node, expression)
+            op = ">"
+            target = ""
+            node_children(node).each do |c|
+              if c.kind == "file_redirection_operator"
+                op = node_raw_text(c, expression).strip
+              elsif c.kind == "redirected_file_name"
+                target = node_text(c, expression).strip
+              end
+            end
+            target = target.sub(/\A\s+/, "")
+            affects = [">", ">>", "2>", "2>>", "*>"].include?(op)
+            Redirect.new(operator: op, target: target, affects_classification: affects)
+          end
+
+          def find_nested_blocks(node, nested_blocks)
+            if node.kind == "script_block"
+              nested_blocks << node
+            else
+              node_children(node).each { |c| find_nested_blocks(c, nested_blocks) }
+            end
+          end
+
+          def node_children(node)
+            (0...node.child_count).map { |i| node.child(i) }
+          end
+
+          def node_raw_text(node, expression)
+            return "" if node.nil?
+
+            expression.byteslice(node.start_byte...node.end_byte) || ""
+          end
+
+          def node_text(node, expression)
+            raw = node_raw_text(node, expression)
+            clean = raw.strip
+            if clean.length >= 2 && ((clean.start_with?('"') && clean.end_with?('"')) ||
+               (clean.start_with?("'") && clean.end_with?("'")))
+              return clean[1..-2]
+            end
+
+            clean
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubik/security/classifier/pwsh_rules.rb

@@ -0,0 +1,224 @@
+# frozen_string_literal: true
+
+require_relative "models"
+
+module Rubik
+  module Security
+    module Classifier
+      module PwshRules
+        def self.definitions
+          @definitions ||= build_definitions
+        end
+
+        def self.[](name)
+          definitions[name.to_s.downcase]
+        end
+
+        def self.key?(name)
+          definitions.key?(name.to_s.downcase)
+        end
+
+        def self.build_definitions
+          defs = {}
+
+          register_file_and_content_commands(defs)
+          register_process_and_execution_commands(defs)
+          register_web_commands(defs)
+          register_dangerous_cmdlets(defs)
+
+          defs
+        end
+
+        def self.register_cmd(defs, command_def)
+          defs[command_def.command.downcase] = command_def
+          command_def.aliases.each do |alias_name|
+            defs[alias_name.downcase] = command_def
+          end
+        end
+
+        def self.register_file_and_content_commands(defs)
+          [
+            build_remove_item,
+            build_get_child_item,
+            build_get_content,
+            build_set_content,
+            build_add_content,
+            build_out_file
+          ].each { |cmd| register_cmd(defs, cmd) }
+        end
+
+        def self.register_process_and_execution_commands(defs)
+          [
+            build_stop_process,
+            build_start_process
+          ].each { |cmd| register_cmd(defs, cmd) }
+        end
+
+        def self.register_web_commands(defs)
+          [
+            build_invoke_webrequest,
+            build_invoke_restmethod
+          ].each { |cmd| register_cmd(defs, cmd) }
+        end
+
+        def self.register_dangerous_cmdlets(defs)
+          dangerous_cmdlets = [
+            "Format-Volume", "Clear-Disk", "Initialize-Disk",
+            "Remove-Partition", "Set-Disk", "Stop-Computer", "Restart-Computer"
+          ]
+          dangerous_cmdlets.each do |cmd_name|
+            register_cmd(
+              defs,
+              CommandDef.new(command: cmd_name, classification: :dangerous, risk: :high, strict: false)
+            )
+          end
+        end
+
+        def self.build_remove_item
+          CommandDef.new(
+            command: "Remove-Item",
+            aliases: ["del", "erase", "rd", "ri", "rm", "rmdir"],
+            classification: :local_effects,
+            risk: :medium,
+            strict: false,
+            options: {
+              "-recurse" => OptionDef.new(aliases: ["-r"]),
+              "-force" => OptionDef.new(aliases: ["-f", "-fo"]),
+              "-path" => OptionDef.new(takes_value: true)
+            }
+          )
+        end
+
+        def self.build_get_child_item
+          CommandDef.new(
+            command: "Get-ChildItem",
+            aliases: ["dir", "gci", "ls"],
+            classification: :readonly,
+            risk: :low,
+            strict: false,
+            options: {
+              "-path" => OptionDef.new(takes_value: true, captures_directory: true),
+              "-recurse" => OptionDef.new(aliases: ["-s", "-r"])
+            }
+          )
+        end
+
+        def self.build_get_content
+          CommandDef.new(
+            command: "Get-Content",
+            aliases: ["cat", "gc", "type"],
+            classification: :readonly,
+            risk: :low,
+            strict: false,
+            options: { "-path" => OptionDef.new(takes_value: true) }
+          )
+        end
+
+        def self.build_stop_process
+          CommandDef.new(
+            command: "Stop-Process",
+            aliases: ["kill", "spps"],
+            classification: :local_effects,
+            risk: :medium,
+            strict: false,
+            options: {
+              "-name" => OptionDef.new(takes_value: true),
+              "-id" => OptionDef.new(takes_value: true),
+              "-force" => OptionDef.new(overrides: :local_effects, risk: :medium)
+            }
+          )
+        end
+
+        def self.build_invoke_webrequest
+          CommandDef.new(
+            command: "Invoke-WebRequest",
+            aliases: ["curl", "iwr", "wget"],
+            classification: :external_effects,
+            risk: :medium,
+            strict: false,
+            options: {
+              "-uri" => OptionDef.new(takes_value: true),
+              "-outfile" => OptionDef.new(takes_value: true)
+            }
+          )
+        end
+
+        def self.build_invoke_restmethod
+          CommandDef.new(
+            command: "Invoke-RestMethod",
+            aliases: ["irm"],
+            classification: :external_effects,
+            risk: :medium,
+            strict: false,
+            options: {
+              "-uri" => OptionDef.new(takes_value: true),
+              "-outfile" => OptionDef.new(takes_value: true)
+            }
+          )
+        end
+
+        def self.build_start_process
+          CommandDef.new(
+            command: "Start-Process",
+            aliases: ["saps", "start"],
+            classification: :local_effects,
+            risk: :medium,
+            strict: false,
+            delegates_to: DelegationConfig.new(mode: :rest_are_argv),
+            options: {
+              "-filepath" => OptionDef.new(takes_value: true),
+              "-argumentlist" => OptionDef.new(takes_value: true)
+            }
+          )
+        end
+
+        def self.build_set_content
+          CommandDef.new(
+            command: "Set-Content",
+            aliases: ["sc"],
+            classification: :local_effects,
+            risk: :medium,
+            strict: false,
+            options: { "-path" => OptionDef.new(takes_value: true) }
+          )
+        end
+
+        def self.build_add_content
+          CommandDef.new(
+            command: "Add-Content",
+            aliases: ["ac"],
+            classification: :local_effects,
+            risk: :medium,
+            strict: false,
+            options: { "-path" => OptionDef.new(takes_value: true) }
+          )
+        end
+
+        def self.build_out_file
+          CommandDef.new(
+            command: "Out-File",
+            classification: :local_effects,
+            risk: :medium,
+            strict: false,
+            options: { "-filepath" => OptionDef.new(takes_value: true) }
+          )
+        end
+
+        private_class_method :register_file_and_content_commands,
+                             :register_process_and_execution_commands,
+                             :register_web_commands,
+                             :register_dangerous_cmdlets,
+                             :build_remove_item,
+                             :build_get_child_item,
+                             :build_get_content,
+                             :build_stop_process,
+                             :build_invoke_webrequest,
+                             :build_invoke_restmethod,
+                             :build_start_process,
+                             :build_set_content,
+                             :build_add_content,
+                             :build_out_file
+      end
+    end
+  end
+end

data/lib/rubik/security/classifier.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+# Originally ported from bash-classify by Filip Procházka (MIT License)
+# https://github.com/fprochazka/bash-classify
+# See ATTRIBUTION.md for full notices and license details.
+
+require_relative "classifier/models"
+require_relative "classifier/database"
+require_relative "classifier/parser"
+require_relative "classifier/matcher"
+require_relative "classifier/classifier"
+
+module Rubik
+  module Security
+    module Classifier
+      def self.classify(expression, shell: nil, database: nil)
+        Engine.classify_expression(expression, database: database, shell: shell)
+      end
+
+      def self.database
+        Engine.default_database
+      end
+    end
+  end
+end

data/lib/rubik/security/errors.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Rubik
+  module Security
+    # Carries structured context (command, rule name, probe-ness, block kind,
+    # offending path) so callers can render situation-specific guidance
+    # instead of regex-munging #message. Kept in its own file: consumers that
+    # only rescue/raise the error (sandbox runner, buffer manager) must not
+    # load the whole guard/classifier stack for the constant.
+    class BlockedWriteError < StandardError
+      attr_accessor :blocked_command, :rule_name, :probe_like, :kind, :path,
+                    :segment_report, :classification_reason
+
+      # Keyword form lets raise sites state every field up front (a field
+      # cannot be forgotten). The attr_accessors (not just readers) keep the
+      # error mutable for test fixtures and future live annotation — no lib
+      # raise site needs the writers today.
+      # segment_report: frozen plain Hash or nil, built by the Guard from the
+      # classifier AST — {segments: [{display:, argv:, rule:, option:, reason:,
+      # depth:}], safe: [String], wrapper_preview: String|nil,
+      # allowlist_entries: [String]}. classification_reason: composed Engine
+      # evidence for expression-level elevations (no segment report exists);
+      # nil for per-command blocks. Plain data only: this file must stay
+      # loadable without the guard/classifier stack.
+      def initialize(message = nil, kind: nil, path: nil, blocked_command: nil,
+                     rule_name: nil, probe_like: nil, segment_report: nil,
+                     classification_reason: nil)
+        super(message)
+        @kind = kind
+        @path = path
+        @blocked_command = blocked_command
+        @rule_name = rule_name
+        @probe_like = probe_like
+        @segment_report = segment_report
+        @classification_reason = classification_reason
+      end
+    end
+  end
+end