@dotsetlabs/tollgate 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +885 -0
- package/dist/analyzers/filesystem.d.ts +26 -0
- package/dist/analyzers/filesystem.d.ts.map +1 -0
- package/dist/analyzers/filesystem.js +284 -0
- package/dist/analyzers/filesystem.js.map +1 -0
- package/dist/analyzers/http.d.ts +90 -0
- package/dist/analyzers/http.d.ts.map +1 -0
- package/dist/analyzers/http.js +433 -0
- package/dist/analyzers/http.js.map +1 -0
- package/dist/analyzers/index.d.ts +101 -0
- package/dist/analyzers/index.d.ts.map +1 -0
- package/dist/analyzers/index.js +342 -0
- package/dist/analyzers/index.js.map +1 -0
- package/dist/analyzers/loader.d.ts +114 -0
- package/dist/analyzers/loader.d.ts.map +1 -0
- package/dist/analyzers/loader.js +184 -0
- package/dist/analyzers/loader.js.map +1 -0
- package/dist/analyzers/prompt-injection.d.ts +95 -0
- package/dist/analyzers/prompt-injection.d.ts.map +1 -0
- package/dist/analyzers/prompt-injection.js +725 -0
- package/dist/analyzers/prompt-injection.js.map +1 -0
- package/dist/analyzers/sdk.d.ts +230 -0
- package/dist/analyzers/sdk.d.ts.map +1 -0
- package/dist/analyzers/sdk.js +283 -0
- package/dist/analyzers/sdk.js.map +1 -0
- package/dist/analyzers/shell.d.ts +20 -0
- package/dist/analyzers/shell.d.ts.map +1 -0
- package/dist/analyzers/shell.js +297 -0
- package/dist/analyzers/shell.js.map +1 -0
- package/dist/analyzers/sql.d.ts +37 -0
- package/dist/analyzers/sql.d.ts.map +1 -0
- package/dist/analyzers/sql.js +455 -0
- package/dist/analyzers/sql.js.map +1 -0
- package/dist/analyzers/types.d.ts +117 -0
- package/dist/analyzers/types.d.ts.map +1 -0
- package/dist/analyzers/types.js +46 -0
- package/dist/analyzers/types.js.map +1 -0
- package/dist/approval/interactive.d.ts +72 -0
- package/dist/approval/interactive.d.ts.map +1 -0
- package/dist/approval/interactive.js +550 -0
- package/dist/approval/interactive.js.map +1 -0
- package/dist/approval/terminal.d.ts +59 -0
- package/dist/approval/terminal.d.ts.map +1 -0
- package/dist/approval/terminal.js +238 -0
- package/dist/approval/terminal.js.map +1 -0
- package/dist/approval/types.d.ts +66 -0
- package/dist/approval/types.d.ts.map +1 -0
- package/dist/approval/types.js +2 -0
- package/dist/approval/types.js.map +1 -0
- package/dist/audit/exporter.d.ts +138 -0
- package/dist/audit/exporter.d.ts.map +1 -0
- package/dist/audit/exporter.js +366 -0
- package/dist/audit/exporter.js.map +1 -0
- package/dist/audit/logger.d.ts +156 -0
- package/dist/audit/logger.d.ts.map +1 -0
- package/dist/audit/logger.js +406 -0
- package/dist/audit/logger.js.map +1 -0
- package/dist/audit/redaction.d.ts +110 -0
- package/dist/audit/redaction.d.ts.map +1 -0
- package/dist/audit/redaction.js +307 -0
- package/dist/audit/redaction.js.map +1 -0
- package/dist/audit/schema.d.ts +76 -0
- package/dist/audit/schema.d.ts.map +1 -0
- package/dist/audit/schema.js +122 -0
- package/dist/audit/schema.js.map +1 -0
- package/dist/cli/commands/doctor.d.ts +34 -0
- package/dist/cli/commands/doctor.d.ts.map +1 -0
- package/dist/cli/commands/doctor.js +431 -0
- package/dist/cli/commands/doctor.js.map +1 -0
- package/dist/cli/commands/export.d.ts +18 -0
- package/dist/cli/commands/export.d.ts.map +1 -0
- package/dist/cli/commands/export.js +63 -0
- package/dist/cli/commands/export.js.map +1 -0
- package/dist/cli/commands/init.d.ts +12 -0
- package/dist/cli/commands/init.d.ts.map +1 -0
- package/dist/cli/commands/init.js +102 -0
- package/dist/cli/commands/init.js.map +1 -0
- package/dist/cli/commands/logs.d.ts +11 -0
- package/dist/cli/commands/logs.d.ts.map +1 -0
- package/dist/cli/commands/logs.js +60 -0
- package/dist/cli/commands/logs.js.map +1 -0
- package/dist/cli/commands/scan.d.ts +29 -0
- package/dist/cli/commands/scan.d.ts.map +1 -0
- package/dist/cli/commands/scan.js +251 -0
- package/dist/cli/commands/scan.js.map +1 -0
- package/dist/cli/commands/serve.d.ts +26 -0
- package/dist/cli/commands/serve.d.ts.map +1 -0
- package/dist/cli/commands/serve.js +424 -0
- package/dist/cli/commands/serve.js.map +1 -0
- package/dist/cli/commands/start.d.ts +20 -0
- package/dist/cli/commands/start.d.ts.map +1 -0
- package/dist/cli/commands/start.js +82 -0
- package/dist/cli/commands/start.js.map +1 -0
- package/dist/cli/commands/stats.d.ts +10 -0
- package/dist/cli/commands/stats.d.ts.map +1 -0
- package/dist/cli/commands/stats.js +42 -0
- package/dist/cli/commands/stats.js.map +1 -0
- package/dist/cli/commands/templates.d.ts +26 -0
- package/dist/cli/commands/templates.d.ts.map +1 -0
- package/dist/cli/commands/templates.js +221 -0
- package/dist/cli/commands/templates.js.map +1 -0
- package/dist/cli/commands/validate.d.ts +12 -0
- package/dist/cli/commands/validate.d.ts.map +1 -0
- package/dist/cli/commands/validate.js +107 -0
- package/dist/cli/commands/validate.js.map +1 -0
- package/dist/cli/commands/wrap.d.ts +19 -0
- package/dist/cli/commands/wrap.d.ts.map +1 -0
- package/dist/cli/commands/wrap.js +59 -0
- package/dist/cli/commands/wrap.js.map +1 -0
- package/dist/cli/index.d.ts +17 -0
- package/dist/cli/index.d.ts.map +1 -0
- package/dist/cli/index.js +202 -0
- package/dist/cli/index.js.map +1 -0
- package/dist/cli/ui.d.ts +139 -0
- package/dist/cli/ui.d.ts.map +1 -0
- package/dist/cli/ui.js +271 -0
- package/dist/cli/ui.js.map +1 -0
- package/dist/constants.d.ts +33 -0
- package/dist/constants.d.ts.map +1 -0
- package/dist/constants.js +54 -0
- package/dist/constants.js.map +1 -0
- package/dist/errors.d.ts +28 -0
- package/dist/errors.d.ts.map +1 -0
- package/dist/errors.js +37 -0
- package/dist/errors.js.map +1 -0
- package/dist/index.d.ts +49 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +82 -0
- package/dist/index.js.map +1 -0
- package/dist/orchestrator/index.d.ts +11 -0
- package/dist/orchestrator/index.d.ts.map +1 -0
- package/dist/orchestrator/index.js +10 -0
- package/dist/orchestrator/index.js.map +1 -0
- package/dist/orchestrator/manager.d.ts +127 -0
- package/dist/orchestrator/manager.d.ts.map +1 -0
- package/dist/orchestrator/manager.js +498 -0
- package/dist/orchestrator/manager.js.map +1 -0
- package/dist/orchestrator/types.d.ts +141 -0
- package/dist/orchestrator/types.d.ts.map +1 -0
- package/dist/orchestrator/types.js +9 -0
- package/dist/orchestrator/types.js.map +1 -0
- package/dist/policy/engine.d.ts +55 -0
- package/dist/policy/engine.d.ts.map +1 -0
- package/dist/policy/engine.js +288 -0
- package/dist/policy/engine.js.map +1 -0
- package/dist/policy/natural-language.d.ts +141 -0
- package/dist/policy/natural-language.d.ts.map +1 -0
- package/dist/policy/natural-language.js +552 -0
- package/dist/policy/natural-language.js.map +1 -0
- package/dist/policy/parser.d.ts +141 -0
- package/dist/policy/parser.d.ts.map +1 -0
- package/dist/policy/parser.js +314 -0
- package/dist/policy/parser.js.map +1 -0
- package/dist/policy/types.d.ts +428 -0
- package/dist/policy/types.d.ts.map +1 -0
- package/dist/policy/types.js +32 -0
- package/dist/policy/types.js.map +1 -0
- package/dist/policy/validator.d.ts +72 -0
- package/dist/policy/validator.d.ts.map +1 -0
- package/dist/policy/validator.js +453 -0
- package/dist/policy/validator.js.map +1 -0
- package/dist/proxy/bridge.d.ts +84 -0
- package/dist/proxy/bridge.d.ts.map +1 -0
- package/dist/proxy/bridge.js +217 -0
- package/dist/proxy/bridge.js.map +1 -0
- package/dist/proxy/client.d.ts +130 -0
- package/dist/proxy/client.d.ts.map +1 -0
- package/dist/proxy/client.js +290 -0
- package/dist/proxy/client.js.map +1 -0
- package/dist/proxy/server.d.ts +111 -0
- package/dist/proxy/server.d.ts.map +1 -0
- package/dist/proxy/server.js +444 -0
- package/dist/proxy/server.js.map +1 -0
- package/dist/scanner.d.ts +91 -0
- package/dist/scanner.d.ts.map +1 -0
- package/dist/scanner.js +373 -0
- package/dist/scanner.js.map +1 -0
- package/dist/session/index.d.ts +32 -0
- package/dist/session/index.d.ts.map +1 -0
- package/dist/session/index.js +31 -0
- package/dist/session/index.js.map +1 -0
- package/dist/session/manager.d.ts +166 -0
- package/dist/session/manager.d.ts.map +1 -0
- package/dist/session/manager.js +454 -0
- package/dist/session/manager.js.map +1 -0
- package/dist/session/sqlite-store.d.ts +54 -0
- package/dist/session/sqlite-store.d.ts.map +1 -0
- package/dist/session/sqlite-store.js +209 -0
- package/dist/session/sqlite-store.js.map +1 -0
- package/dist/session/types.d.ts +179 -0
- package/dist/session/types.d.ts.map +1 -0
- package/dist/session/types.js +38 -0
- package/dist/session/types.js.map +1 -0
- package/dist/templates.d.ts +64 -0
- package/dist/templates.d.ts.map +1 -0
- package/dist/templates.js +451 -0
- package/dist/templates.js.map +1 -0
- package/dist/utils/config.d.ts +57 -0
- package/dist/utils/config.d.ts.map +1 -0
- package/dist/utils/config.js +104 -0
- package/dist/utils/config.js.map +1 -0
- package/dist/utils/errors.d.ts +18 -0
- package/dist/utils/errors.d.ts.map +1 -0
- package/dist/utils/errors.js +35 -0
- package/dist/utils/errors.js.map +1 -0
- package/dist/utils/logger.d.ts +144 -0
- package/dist/utils/logger.d.ts.map +1 -0
- package/dist/utils/logger.js +300 -0
- package/dist/utils/logger.js.map +1 -0
- package/dist/wizard.d.ts +68 -0
- package/dist/wizard.d.ts.map +1 -0
- package/dist/wizard.js +395 -0
- package/dist/wizard.js.map +1 -0
- package/package.json +99 -0
|
@@ -0,0 +1,297 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Shell Command Analyzer
|
|
3
|
+
*
|
|
4
|
+
* Detects dangerous shell commands and patterns:
|
|
5
|
+
* - Destructive commands (rm -rf, mkfs, dd)
|
|
6
|
+
* - Privilege escalation (sudo, su)
|
|
7
|
+
* - Remote code execution (curl | bash)
|
|
8
|
+
* - System modification (chmod 777, chown)
|
|
9
|
+
*/
|
|
10
|
+
export class ShellAnalyzer {
|
|
11
|
+
name = 'shell';
|
|
12
|
+
// Commands that should never be run
|
|
13
|
+
FORBIDDEN_COMMANDS = [
|
|
14
|
+
// Fork bomb - use bounded whitespace to prevent ReDoS
|
|
15
|
+
{
|
|
16
|
+
pattern: /:\(\)\s{0,5}\{\s{0,5}:\|:&\s{0,5}\}\s{0,5};?\s{0,5}:/,
|
|
17
|
+
risk: 'dangerous',
|
|
18
|
+
reason: 'Fork bomb detected - will crash system',
|
|
19
|
+
category: 'fork_bomb',
|
|
20
|
+
},
|
|
21
|
+
// Disk destruction
|
|
22
|
+
{
|
|
23
|
+
pattern: /\bdd\s+.*\bif=.*\bof=\/dev\/[hs]d/i,
|
|
24
|
+
risk: 'dangerous',
|
|
25
|
+
reason: 'Direct disk write detected - can destroy filesystem',
|
|
26
|
+
category: 'disk_destruction',
|
|
27
|
+
},
|
|
28
|
+
// Format filesystem
|
|
29
|
+
{
|
|
30
|
+
pattern: /\b(mkfs|mke2fs|mkfs\.\w+)\b/i,
|
|
31
|
+
risk: 'dangerous',
|
|
32
|
+
reason: 'Filesystem format command detected',
|
|
33
|
+
category: 'disk_destruction',
|
|
34
|
+
},
|
|
35
|
+
// Wipe commands
|
|
36
|
+
{
|
|
37
|
+
pattern: /\b(shred|wipe)\s+/i,
|
|
38
|
+
risk: 'dangerous',
|
|
39
|
+
reason: 'Secure deletion command detected',
|
|
40
|
+
category: 'disk_destruction',
|
|
41
|
+
},
|
|
42
|
+
];
|
|
43
|
+
// Commands that are dangerous in certain contexts
|
|
44
|
+
DANGEROUS_PATTERNS = [
|
|
45
|
+
// rm with dangerous flags or paths
|
|
46
|
+
{
|
|
47
|
+
pattern: /\brm\s+(-[rRf]+\s+)*[/~]/,
|
|
48
|
+
risk: 'dangerous',
|
|
49
|
+
reason: 'rm command targeting root or home directory',
|
|
50
|
+
category: 'file_deletion',
|
|
51
|
+
},
|
|
52
|
+
{
|
|
53
|
+
pattern: /\brm\s+-[rRf]*\s+-[rRf]*\s/,
|
|
54
|
+
risk: 'destructive',
|
|
55
|
+
reason: 'rm with recursive/force flags',
|
|
56
|
+
category: 'file_deletion',
|
|
57
|
+
},
|
|
58
|
+
// sudo commands
|
|
59
|
+
{
|
|
60
|
+
pattern: /\bsudo\s+/,
|
|
61
|
+
risk: 'dangerous',
|
|
62
|
+
reason: 'Privilege escalation with sudo',
|
|
63
|
+
category: 'privilege_escalation',
|
|
64
|
+
},
|
|
65
|
+
// su commands
|
|
66
|
+
{
|
|
67
|
+
pattern: /\bsu\s+(-|root|\s*$)/,
|
|
68
|
+
risk: 'dangerous',
|
|
69
|
+
reason: 'Switch to root user',
|
|
70
|
+
category: 'privilege_escalation',
|
|
71
|
+
},
|
|
72
|
+
// chmod with dangerous permissions
|
|
73
|
+
{
|
|
74
|
+
pattern: /\bchmod\s+([0-7]*7[0-7]{2}|[0-7]{2}7|a\+[rwx])/,
|
|
75
|
+
risk: 'destructive',
|
|
76
|
+
reason: 'chmod with overly permissive settings',
|
|
77
|
+
category: 'permission_change',
|
|
78
|
+
},
|
|
79
|
+
// chown to root
|
|
80
|
+
{
|
|
81
|
+
pattern: /\bchown\s+(root|0)/i,
|
|
82
|
+
risk: 'destructive',
|
|
83
|
+
reason: 'Changing ownership to root',
|
|
84
|
+
category: 'permission_change',
|
|
85
|
+
},
|
|
86
|
+
// Remote code execution via curl/wget
|
|
87
|
+
{
|
|
88
|
+
pattern: /\b(curl|wget)\s+.*\|\s*(ba)?sh/i,
|
|
89
|
+
risk: 'dangerous',
|
|
90
|
+
reason: 'Remote code execution: piping download to shell',
|
|
91
|
+
category: 'remote_code_execution',
|
|
92
|
+
},
|
|
93
|
+
// eval with variable
|
|
94
|
+
{
|
|
95
|
+
pattern: /\beval\s+["']?\$/,
|
|
96
|
+
risk: 'dangerous',
|
|
97
|
+
reason: 'eval with variable input - potential injection',
|
|
98
|
+
category: 'code_injection',
|
|
99
|
+
},
|
|
100
|
+
// Writing to /dev
|
|
101
|
+
{
|
|
102
|
+
pattern: />\s*\/dev\/[hs]d/,
|
|
103
|
+
risk: 'dangerous',
|
|
104
|
+
reason: 'Writing directly to disk device',
|
|
105
|
+
category: 'disk_destruction',
|
|
106
|
+
},
|
|
107
|
+
// System reboot/shutdown
|
|
108
|
+
{
|
|
109
|
+
pattern: /\b(reboot|shutdown|poweroff|halt|init\s+[06])\b/,
|
|
110
|
+
risk: 'dangerous',
|
|
111
|
+
reason: 'System shutdown/reboot command',
|
|
112
|
+
category: 'system_control',
|
|
113
|
+
},
|
|
114
|
+
// Kill all processes
|
|
115
|
+
{
|
|
116
|
+
pattern: /\bkillall\s+(-9\s+)?-/,
|
|
117
|
+
risk: 'dangerous',
|
|
118
|
+
reason: 'Killing multiple processes',
|
|
119
|
+
category: 'process_control',
|
|
120
|
+
},
|
|
121
|
+
{
|
|
122
|
+
pattern: /\bpkill\s+-9/,
|
|
123
|
+
risk: 'destructive',
|
|
124
|
+
reason: 'Force killing processes',
|
|
125
|
+
category: 'process_control',
|
|
126
|
+
},
|
|
127
|
+
// iptables flush
|
|
128
|
+
{
|
|
129
|
+
pattern: /\biptables\s+(-F|--flush)/,
|
|
130
|
+
risk: 'dangerous',
|
|
131
|
+
reason: 'Flushing firewall rules',
|
|
132
|
+
category: 'network',
|
|
133
|
+
},
|
|
134
|
+
// System service control
|
|
135
|
+
{
|
|
136
|
+
pattern: /\b(systemctl|service)\s+(stop|disable|mask)\s+/,
|
|
137
|
+
risk: 'destructive',
|
|
138
|
+
reason: 'Stopping system service',
|
|
139
|
+
category: 'system_control',
|
|
140
|
+
},
|
|
141
|
+
// Package removal
|
|
142
|
+
{
|
|
143
|
+
pattern: /\b(apt|apt-get|yum|dnf|pacman)\s+(remove|purge|autoremove)\s+/,
|
|
144
|
+
risk: 'destructive',
|
|
145
|
+
reason: 'Removing system packages',
|
|
146
|
+
category: 'package_management',
|
|
147
|
+
},
|
|
148
|
+
// npm/pip with sudo
|
|
149
|
+
{
|
|
150
|
+
pattern: /\bsudo\s+(npm|pip|pip3)\s+/,
|
|
151
|
+
risk: 'destructive',
|
|
152
|
+
reason: 'Installing packages with root privileges',
|
|
153
|
+
category: 'package_management',
|
|
154
|
+
},
|
|
155
|
+
// Environment variable manipulation that could affect PATH
|
|
156
|
+
{
|
|
157
|
+
pattern: /\bexport\s+PATH=/,
|
|
158
|
+
risk: 'destructive',
|
|
159
|
+
reason: 'Modifying PATH environment variable',
|
|
160
|
+
category: 'environment',
|
|
161
|
+
},
|
|
162
|
+
// Git force push
|
|
163
|
+
{
|
|
164
|
+
pattern: /\bgit\s+push\s+.*(-f|--force)/,
|
|
165
|
+
risk: 'destructive',
|
|
166
|
+
reason: 'Git force push - can overwrite history',
|
|
167
|
+
category: 'version_control',
|
|
168
|
+
},
|
|
169
|
+
// Git reset hard
|
|
170
|
+
{
|
|
171
|
+
pattern: /\bgit\s+reset\s+--hard/,
|
|
172
|
+
risk: 'destructive',
|
|
173
|
+
reason: 'Git hard reset - discards uncommitted changes',
|
|
174
|
+
category: 'version_control',
|
|
175
|
+
},
|
|
176
|
+
// Docker system prune
|
|
177
|
+
{
|
|
178
|
+
pattern: /\bdocker\s+(system\s+prune|rm\s+-f)/,
|
|
179
|
+
risk: 'destructive',
|
|
180
|
+
reason: 'Docker cleanup - may remove important containers/images',
|
|
181
|
+
category: 'container',
|
|
182
|
+
},
|
|
183
|
+
];
|
|
184
|
+
// Patterns that warrant attention but aren't necessarily dangerous
|
|
185
|
+
CAUTION_PATTERNS = [
|
|
186
|
+
{
|
|
187
|
+
pattern: /\brm\s+/,
|
|
188
|
+
risk: 'destructive',
|
|
189
|
+
reason: 'File deletion command',
|
|
190
|
+
category: 'file_deletion',
|
|
191
|
+
},
|
|
192
|
+
{
|
|
193
|
+
pattern: /\bmv\s+.*\s+\/dev\/null/,
|
|
194
|
+
risk: 'destructive',
|
|
195
|
+
reason: 'Moving file to /dev/null (deletion)',
|
|
196
|
+
category: 'file_deletion',
|
|
197
|
+
},
|
|
198
|
+
{
|
|
199
|
+
pattern: />\s*[^|&]/,
|
|
200
|
+
risk: 'destructive',
|
|
201
|
+
reason: 'File overwrite with redirect',
|
|
202
|
+
category: 'file_modification',
|
|
203
|
+
},
|
|
204
|
+
{
|
|
205
|
+
pattern: /\bchmod\s+/,
|
|
206
|
+
risk: 'destructive',
|
|
207
|
+
reason: 'Changing file permissions',
|
|
208
|
+
category: 'permission_change',
|
|
209
|
+
},
|
|
210
|
+
{
|
|
211
|
+
pattern: /\bchown\s+/,
|
|
212
|
+
risk: 'destructive',
|
|
213
|
+
reason: 'Changing file ownership',
|
|
214
|
+
category: 'permission_change',
|
|
215
|
+
},
|
|
216
|
+
];
|
|
217
|
+
analyze(command, _context) {
|
|
218
|
+
// Normalize the command
|
|
219
|
+
const normalizedCommand = this.normalizeCommand(command);
|
|
220
|
+
// Check forbidden commands first
|
|
221
|
+
for (const { pattern, risk, reason, category } of this.FORBIDDEN_COMMANDS) {
|
|
222
|
+
if (pattern.test(normalizedCommand)) {
|
|
223
|
+
return {
|
|
224
|
+
risk,
|
|
225
|
+
reason,
|
|
226
|
+
triggers: [category],
|
|
227
|
+
metadata: { category, pattern: pattern.source },
|
|
228
|
+
};
|
|
229
|
+
}
|
|
230
|
+
}
|
|
231
|
+
// Check dangerous patterns
|
|
232
|
+
for (const { pattern, risk, reason, category } of this.DANGEROUS_PATTERNS) {
|
|
233
|
+
if (pattern.test(normalizedCommand)) {
|
|
234
|
+
return {
|
|
235
|
+
risk,
|
|
236
|
+
reason,
|
|
237
|
+
triggers: [category],
|
|
238
|
+
metadata: { category, pattern: pattern.source },
|
|
239
|
+
};
|
|
240
|
+
}
|
|
241
|
+
}
|
|
242
|
+
// Check caution patterns
|
|
243
|
+
for (const { pattern, risk, reason, category } of this.CAUTION_PATTERNS) {
|
|
244
|
+
if (pattern.test(normalizedCommand)) {
|
|
245
|
+
return {
|
|
246
|
+
risk,
|
|
247
|
+
reason,
|
|
248
|
+
triggers: [category],
|
|
249
|
+
metadata: { category, pattern: pattern.source },
|
|
250
|
+
};
|
|
251
|
+
}
|
|
252
|
+
}
|
|
253
|
+
// Check for command chaining that might hide malicious commands
|
|
254
|
+
if (this.hasSuspiciousChaining(normalizedCommand)) {
|
|
255
|
+
return {
|
|
256
|
+
risk: 'destructive',
|
|
257
|
+
reason: 'Complex command chaining detected - review carefully',
|
|
258
|
+
triggers: ['command_chaining'],
|
|
259
|
+
};
|
|
260
|
+
}
|
|
261
|
+
// Default: command appears safe
|
|
262
|
+
return {
|
|
263
|
+
risk: 'safe',
|
|
264
|
+
reason: 'No dangerous patterns detected',
|
|
265
|
+
};
|
|
266
|
+
}
|
|
267
|
+
normalizeCommand(command) {
|
|
268
|
+
// Remove extra whitespace
|
|
269
|
+
let normalized = command.trim().replace(/\s+/g, ' ');
|
|
270
|
+
// Expand common aliases (conservative list)
|
|
271
|
+
normalized = normalized.replace(/\bll\b/g, 'ls -l');
|
|
272
|
+
return normalized;
|
|
273
|
+
}
|
|
274
|
+
hasSuspiciousChaining(command) {
|
|
275
|
+
// Count chain operators
|
|
276
|
+
const chainOperators = (command.match(/[;&|]{1,2}/g) ?? []).length;
|
|
277
|
+
// More than 3 chained commands is suspicious
|
|
278
|
+
if (chainOperators > 3) {
|
|
279
|
+
return true;
|
|
280
|
+
}
|
|
281
|
+
// Check for hiding patterns like: innocent && dangerous
|
|
282
|
+
const parts = command.split(/[;&|]+/);
|
|
283
|
+
if (parts.length >= 2) {
|
|
284
|
+
// If first command is innocuous but later ones are dangerous
|
|
285
|
+
const firstSafe = /^(echo|ls|pwd|cd|cat|head|tail)\b/.test(parts[0]?.trim() ?? '');
|
|
286
|
+
const laterDangerous = parts.slice(1).some(part => {
|
|
287
|
+
const trimmed = part.trim();
|
|
288
|
+
return /^(rm|sudo|curl.*\|.*sh|dd|mkfs)/.test(trimmed);
|
|
289
|
+
});
|
|
290
|
+
if (firstSafe && laterDangerous) {
|
|
291
|
+
return true;
|
|
292
|
+
}
|
|
293
|
+
}
|
|
294
|
+
return false;
|
|
295
|
+
}
|
|
296
|
+
}
|
|
297
|
+
//# sourceMappingURL=shell.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/analyzers/shell.ts"],"names":[],"mappings":"AASA;;;;;;;;GAQG;AACH,MAAM,OAAO,aAAa;IACf,IAAI,GAAG,OAAO,CAAC;IAExB,oCAAoC;IACnB,kBAAkB,GAAuB;QACxD,sDAAsD;QACtD;YACE,OAAO,EAAE,sDAAsD;YAC/D,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,wCAAwC;YAChD,QAAQ,EAAE,WAAW;SACtB;QACD,mBAAmB;QACnB;YACE,OAAO,EAAE,oCAAoC;YAC7C,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,qDAAqD;YAC7D,QAAQ,EAAE,kBAAkB;SAC7B;QACD,oBAAoB;QACpB;YACE,OAAO,EAAE,8BAA8B;YACvC,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,oCAAoC;YAC5C,QAAQ,EAAE,kBAAkB;SAC7B;QACD,gBAAgB;QAChB;YACE,OAAO,EAAE,oBAAoB;YAC7B,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,kCAAkC;YAC1C,QAAQ,EAAE,kBAAkB;SAC7B;KACF,CAAC;IAEF,kDAAkD;IACjC,kBAAkB,GAAuB;QACxD,mCAAmC;QACnC;YACE,OAAO,EAAE,0BAA0B;YACnC,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,6CAA6C;YACrD,QAAQ,EAAE,eAAe;SAC1B;QACD;YACE,OAAO,EAAE,4BAA4B;YACrC,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,+BAA+B;YACvC,QAAQ,EAAE,eAAe;SAC1B;QACD,gBAAgB;QAChB;YACE,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,gCAAgC;YACxC,QAAQ,EAAE,sBAAsB;SACjC;QACD,cAAc;QACd;YACE,OAAO,EAAE,sBAAsB;YAC/B,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,qBAAqB;YAC7B,QAAQ,EAAE,sBAAsB;SACjC;QACD,mCAAmC;QACnC;YACE,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,uCAAuC;YAC/C,QAAQ,EAAE,mBAAmB;SAC9B;QACD,gBAAgB;QAChB;YACE,OAAO,EAAE,qBAAqB;YAC9B,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,4BAA4B;YACpC,QAAQ,EAAE,mBAAmB;SAC9B;QACD,sCAAsC;QACtC;YACE,OAAO,EAAE,iCAAiC;YAC1C,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,iDAAiD;YACzD,QAAQ,EAAE,uBAAuB;SAClC;QACD,qBAAqB;QACrB;YACE,OAAO,EAAE,kBAAkB;YAC3B,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,gDAAgD;YACxD,QAAQ,EAAE,gBAAgB;SAC3B;QACD,kBAAkB;QAClB;YACE,OAAO,EAAE,kBAAkB;YAC3B,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,iCAAiC;YACzC,QAAQ,EAAE,kBAAkB;SAC7B;QACD,yBAAyB;QACzB;YACE,OAAO,EAAE,iDAAiD;YAC1D,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,gCAAgC;YACxC,QAAQ,EAAE,gBAAgB;SAC3B;QACD,qBAAqB;QACrB;YACE,OAAO,EAAE,uBAAuB;YAChC,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,4BAA4B;YACpC,QAAQ,EAAE,iBAAiB;SAC5B;QACD;YACE,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,iBAAiB;SAC5B;QACD,iBAAiB;QACjB;YACE,OAAO,EAAE,2BAA2B;YACpC,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,SAAS;SACpB;QACD,yBAAyB;QACzB;YACE,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,gBAAgB;SAC3B;QACD,kBAAkB;QAClB;YACE,OAAO,EAAE,+DAA+D;YACxE,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,0BAA0B;YAClC,QAAQ,EAAE,oBAAoB;SAC/B;QACD,oBAAoB;QACpB;YACE,OAAO,EAAE,4BAA4B;YACrC,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,0CAA0C;YAClD,QAAQ,EAAE,oBAAoB;SAC/B;QACD,2DAA2D;QAC3D;YACE,OAAO,EAAE,kBAAkB;YAC3B,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,qCAAqC;YAC7C,QAAQ,EAAE,aAAa;SACxB;QACD,iBAAiB;QACjB;YACE,OAAO,EAAE,+BAA+B;YACxC,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,wCAAwC;YAChD,QAAQ,EAAE,iBAAiB;SAC5B;QACD,iBAAiB;QACjB;YACE,OAAO,EAAE,wBAAwB;YACjC,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,+CAA+C;YACvD,QAAQ,EAAE,iBAAiB;SAC5B;QACD,sBAAsB;QACtB;YACE,OAAO,EAAE,qCAAqC;YAC9C,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,yDAAyD;YACjE,QAAQ,EAAE,WAAW;SACtB;KACF,CAAC;IAEF,mEAAmE;IAClD,gBAAgB,GAAuB;QACtD;YACE,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,uBAAuB;YAC/B,QAAQ,EAAE,eAAe;SAC1B;QACD;YACE,OAAO,EAAE,yBAAyB;YAClC,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,qCAAqC;YAC7C,QAAQ,EAAE,eAAe;SAC1B;QACD;YACE,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,8BAA8B;YACtC,QAAQ,EAAE,mBAAmB;SAC9B;QACD;YACE,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,2BAA2B;YACnC,QAAQ,EAAE,mBAAmB;SAC9B;QACD;YACE,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,yBAAyB;YACjC,QAAQ,EAAE,mBAAmB;SAC9B;KACF,CAAC;IAEF,OAAO,CAAC,OAAe,EAAE,QAA0B;QACjD,wBAAwB;QACxB,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEzD,iCAAiC;QACjC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,IAAI;oBACJ,MAAM;oBACN,QAAQ,EAAE,CAAC,QAAQ,CAAC;oBACpB,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE;iBAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,IAAI;oBACJ,MAAM;oBACN,QAAQ,EAAE,CAAC,QAAQ,CAAC;oBACpB,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE;iBAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxE,IAAI,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,IAAI;oBACJ,MAAM;oBACN,QAAQ,EAAE,CAAC,QAAQ,CAAC;oBACpB,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE;iBAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,sDAAsD;gBAC9D,QAAQ,EAAE,CAAC,kBAAkB,CAAC;aAC/B,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,gCAAgC;SACzC,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,OAAe;QACtC,0BAA0B;QAC1B,IAAI,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAErD,4CAA4C;QAC5C,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEpD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,qBAAqB,CAAC,OAAe;QAC3C,wBAAwB;QACxB,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAEnE,6CAA6C;QAC7C,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,wDAAwD;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACtB,6DAA6D;YAC7D,MAAM,SAAS,GAAG,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,OAAO,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;YAEH,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
import type { AnalysisResult, ContentAnalyzer, AnalyzerContext } from './types.js';
|
|
2
|
+
/**
|
|
3
|
+
* SQL Statement Analyzer
|
|
4
|
+
*
|
|
5
|
+
* Classifies SQL statements by risk level:
|
|
6
|
+
* - read: SELECT statements
|
|
7
|
+
* - write: INSERT statements
|
|
8
|
+
* - write/destructive: UPDATE/DELETE with WHERE clause
|
|
9
|
+
* - dangerous: UPDATE/DELETE without WHERE, DROP, TRUNCATE, ALTER
|
|
10
|
+
*/
|
|
11
|
+
export declare class SqlAnalyzer implements ContentAnalyzer {
|
|
12
|
+
readonly name = "sql";
|
|
13
|
+
private parser;
|
|
14
|
+
constructor();
|
|
15
|
+
analyze(sql: string, _context?: AnalyzerContext): AnalysisResult;
|
|
16
|
+
private analyzeStatement;
|
|
17
|
+
private analyzeSelect;
|
|
18
|
+
private analyzeUpdate;
|
|
19
|
+
private analyzeDelete;
|
|
20
|
+
private isAlwaysTrueCondition;
|
|
21
|
+
private checkDangerousPatterns;
|
|
22
|
+
/**
|
|
23
|
+
* Remove SQL comments for pattern matching
|
|
24
|
+
* Handles both -- line comments and /* block comments
|
|
25
|
+
*/
|
|
26
|
+
private removeComments;
|
|
27
|
+
/**
|
|
28
|
+
* Count semicolons that are outside of string literals
|
|
29
|
+
*/
|
|
30
|
+
private countSemicolonsOutsideStrings;
|
|
31
|
+
/**
|
|
32
|
+
* Check for functions that can cause DoS / resource exhaustion
|
|
33
|
+
*/
|
|
34
|
+
private checkDosFunctions;
|
|
35
|
+
private isHigherRisk;
|
|
36
|
+
}
|
|
37
|
+
//# sourceMappingURL=sql.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../../src/analyzers/sql.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEnF;;;;;;;;GAQG;AACH,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,IAAI,SAAS;IACtB,OAAO,CAAC,MAAM,CAA8B;;IAM5C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,cAAc;IAwChE,OAAO,CAAC,gBAAgB;IAsExB,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,aAAa;IA6BrB,OAAO,CAAC,aAAa;IA6BrB,OAAO,CAAC,qBAAqB;IAqB7B,OAAO,CAAC,sBAAsB;IA4E9B;;;OAGG;IACH,OAAO,CAAC,cAAc;IA6DtB;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAoCrC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAiGzB,OAAO,CAAC,YAAY;CAIrB"}
|