@goodandready/dsh-approval-gate 0.1.7 → 0.1.8

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.1.8
+
+- Paths: нормализация разделителей путей `normalizeSeparators` для кроссплатформенной обработки Windows (`\`) и POSIX (`/`) слешей (Refs: #109).
+- Paths: канонизация путей и превентивная защита от path traversal обходов (`..`, `.` сегменты) `canonicalizePath` и `isPathTraversal` (Refs: #94).
+- Security: блокировка модификации скрытых системных файлов и каталогов конфигурации (`.git`, `.env`, `.ssh`) в путях инструментов и перенаправлениях shell (Refs: #108).
+- Security: защита от утечки переменных окружения и секретов через команды `env`, `printenv`, `export` (Refs: #105).
+- Bands: безусловное разрешение безопасных read-only инструментов и инспекций файловой системы через Band 1 (`isReadOnlyTool`, `isSafeInspectionCommand`) (Refs: #120).
+
 ## 0.1.7
 
 - Canonical: каноническая сериализация вызовов инструментов `canonicalizeCall` со стабильной рекурсивной сортировкой ключей и хэшированием `hashCall` (Refs: #124).

package/lib/bands.js

@@ -1,7 +1,7 @@
 // lib/bands.js
 // Two-band deterministic filtering engine for dsh-approval-gate.
 // Band 0: Hard Deny (fast regexes for exfiltration, fork-bombs, disk wipes)
-// Band 1: Safe Allow (prefix globs & curated safe inspection commands)
+// Band 1: Safe Allow (prefix globs & curated safe read-only inspection commands and tools)
 
 export const DEFAULT_DENY_PATTERNS = Object.freeze([
   /\b(?:nc|ncat|netcat)\s+.*-e\s+/i,
@@ -16,20 +16,50 @@ export const DEFAULT_DENY_PATTERNS = Object.freeze([
 ]);
 
 export const DEFAULT_ALLOW_GLOBS = Object.freeze([
+  // Git inspection commands
   "git status*",
   "git diff*",
   "git log*",
   "git branch*",
   "git show*",
-  "ls*",
-  "pwd*",
+  "git remote*",
+  "git tag*",
+  "git rev-parse*",
+
+  // File viewing & analysis
   "cat *",
   "head *",
   "tail *",
+  "more *",
+  "less *",
   "wc *",
+  "file *",
+  "stat *",
+  "diff *",
+
+  // Search & finding
+  "grep *",
+  "fgrep *",
+  "egrep *",
+  "rg *",
+  "ag *",
+  "find *",
+
+  // Directory listing & environment info
+  "ls*",
+  "dir*",
+  "pwd*",
   "which *",
   "whereis *",
   "whoami*",
+  "hostname*",
+  "uname*",
+  "date*",
+  "uptime*",
+  "echo *",
+  "printf *",
+
+  // Language / runtime versions & test runners
   "node --version*",
   "node -v*",
   "npm test*",
@@ -45,21 +75,32 @@ export const DEFAULT_ALLOW_GLOBS = Object.freeze([
   "pytest*",
   "python --version*",
   "python3 --version*",
-  "echo *",
 ]);
 
 export const DEFAULT_READ_ONLY_TOOLS = Object.freeze([
   "read",
   "read_file",
   "readFile",
+  "read_file_content",
   "view_file",
+  "view",
+  "show",
   "glob",
   "grep",
   "find_files",
+  "find_by_name",
   "search_code",
   "file_search",
   "list_dir",
   "list_directory",
+  "directory_list",
+  "tree",
+  "read_url_content",
+  "fetch_web_page",
+  "web_search",
+  "search_web",
+  "list_resources",
+  "read_resource",
 ]);
 
 /**
@@ -79,7 +120,11 @@ export function compileGlob(pattern) {
 
 export class BandsEngine {
   /**
-   * @param {{ denyPatterns?: Array<RegExp|string>, allowGlobs?: Array<RegExp|string>, readOnlyTools?: Array<string> }} [options]
+   * @param {{
+   *   denyPatterns?: Array<RegExp|string>,
+   *   allowGlobs?: Array<RegExp|string>,
+   *   readOnlyTools?: Array<string>
+   * }} [options]
    */
   constructor(options = {}) {
     this.denyPatterns = (options.denyPatterns || DEFAULT_DENY_PATTERNS).map((p) =>
@@ -91,6 +136,52 @@ export class BandsEngine {
     this.readOnlyTools = new Set(options.readOnlyTools || DEFAULT_READ_ONLY_TOOLS);
   }
 
+  /**
+   * Check if a tool is configured as an unconditional read-only tool.
+   * @param {string} tool
+   * @returns {boolean}
+   */
+  isReadOnlyTool(tool) {
+    return typeof tool === "string" && this.readOnlyTools.has(tool.trim());
+  }
+
+  /**
+   * Check if a command matches safe inspection patterns.
+   * @param {string} command
+   * @returns {boolean}
+   */
+  isSafeInspectionCommand(command) {
+    if (typeof command !== "string" || command.trim() === "") return false;
+    const text = command.trim();
+    for (const pattern of this.denyPatterns) {
+      if (pattern.test(text)) return false;
+    }
+    for (const glob of this.allowGlobs) {
+      if (glob.test(text)) return true;
+    }
+    return false;
+  }
+
+  /**
+   * Register an additional read-only tool name.
+   * @param {string} tool
+   */
+  addReadOnlyTool(tool) {
+    if (typeof tool === "string" && tool.trim()) {
+      this.readOnlyTools.add(tool.trim());
+    }
+  }
+
+  /**
+   * Register an additional allow-glob pattern.
+   * @param {string} globPattern
+   */
+  addAllowGlob(globPattern) {
+    if (typeof globPattern === "string" && globPattern.trim()) {
+      this.allowGlobs.push(compileGlob(globPattern.trim()));
+    }
+  }
+
   /**
    * Evaluates an execution request through Band 0 and Band 1.
    * @param {string} tool - Tool name
@@ -98,7 +189,7 @@ export class BandsEngine {
    * @returns {"deny" | "allow" | "unmatched"}
    */
   evaluate(tool, command) {
-    if (this.readOnlyTools.has(tool)) {
+    if (this.isReadOnlyTool(tool)) {
       return "allow";
     }
 
@@ -123,3 +214,4 @@ export class BandsEngine {
     return "unmatched";
   }
 }
+

package/lib/inspect.js

@@ -1,10 +1,54 @@
+
+export function checkEnvExfiltration(words, fullCommand = "") {
+  if (!Array.isArray(words) || words.length === 0) return { deny: false };
+  const cmd = basename(words[0]);
+
+  // 1. Reading /proc/*/environ
+  if (fullCommand && /\/proc\/(?:self|\$\$|\d+)\/environ\b/i.test(fullCommand)) {
+    return { deny: true, reason: "env-dump-leak", detail: "Attempted read of process environ file" };
+  }
+
+  // 2. Bare env
+  if (cmd === "env") {
+    if (words.length === 1) {
+      return { deny: true, reason: "env-dump-leak", detail: "Bare env command dumps all process secrets" };
+    }
+    const nonEnvWords = words.slice(1).filter((w) => !w.startsWith("-"));
+    const onlyAssignments = nonEnvWords.length > 0 && nonEnvWords.every((w) => w.includes("="));
+    if (nonEnvWords.length === 0 || onlyAssignments) {
+      return { deny: true, reason: "env-dump-leak", detail: "env invocation without command dumps environment" };
+    }
+  }
+
+  // 3. Bare printenv or sensitive key read
+  if (cmd === "printenv") {
+    if (words.length === 1) {
+      return { deny: true, reason: "env-dump-leak", detail: "Bare printenv command dumps all process secrets" };
+    }
+    for (const w of words.slice(1)) {
+      if (/(?:secret|token|key|password|credential|auth|dsh_)/i.test(w)) {
+        return { deny: true, reason: "env-dump-leak", detail: "printenv querying sensitive variable" };
+      }
+    }
+  }
+
+  // 4. export without assignment
+  if (cmd === "export") {
+    if (words.length === 1 || (words.length === 2 && words[1] === "-p")) {
+      return { deny: true, reason: "env-dump-leak", detail: "export without assignment dumps environment" };
+    }
+  }
+
+  return { deny: false };
+}
+
 import { DYNAMIC_MARKER, HEREDOC_OPS, REDIR_OPS, SPLIT_OPS, tokenize, readCommandSubstitution, readBacktick, readParameterExpansion } from "./tokenizer.js";
-import { expandHome } from "./paths.js";
+import { expandHome, isProtectedConfigPath } from "./paths.js";
 import { askMessage, denyMessage, sessionTag } from "./messages.js";
 
 export { DYNAMIC_MARKER, tokenize, splitSubcommands } from "./tokenizer.js";
 export { askMessage, denyMessage, sessionTag } from "./messages.js";
-export { expandHome } from "./paths.js";
+export { expandHome, isProtectedConfigPath } from "./paths.js";
 
 // Pure command/path inspector for dsh-approval-gate.
 // No Cordis imports: unit tests run this without the harness.
@@ -40,19 +84,7 @@ export function basename(path) {
 
 export function isProtectedPath(path, env = process.env) {
   if (typeof path !== "string" || path.trim() === "") return false;
-  const expanded = expandHome(path, env);
-  const normalized = expanded.replace(/\\/g, "/");
-  if (normalized.includes("/etc/sudoers.d/")) return true;
-  const base = basename(normalized);
-  if (base === ".env" || base.startsWith(".env.")) return true;
-  if (/^credentials\.ya?ml$/i.test(base)) return true;
-  if (/^settings\.ya?ml$/i.test(base)) return true;
-  if (base === "cordis.patch.yml") return true;
-  if (/\.(pem|key|crt|p12|pfx)$/i.test(base)) return true;
-  if (/^(id_rsa|id_ed25519|id_ecdsa)$/.test(base)) return true;
-  if (/^(shadow|gshadow|shadow-|gshadow-|sudoers|authorized_keys2?)$/i.test(base)) return true;
-  if (/(?:^|[._-])(?:secret|token|credential|passwd|api[_-]?key)(?:$|[._-])/i.test(base)) return true;
-  return false;
+  return isProtectedConfigPath(path, env);
 }
 
 function wordsOf(seg) {
@@ -190,6 +222,18 @@ function inspectArgv(argv, depth, hasHeredoc) {
   const cmd = basename(argv[0]);
   const rest = argv.slice(1);
 
+  const envHit = checkEnvExfiltration(argv, argv.join(" "));
+  if (envHit.deny) {
+    return deny("env-dump-leak", envHit.detail || argv.join(" "));
+  }
+
+  if (cmd === "env") {
+    const sub = rest.filter(a => !a.startsWith("-") && !a.includes("="));
+    if (sub.length > 0) {
+      return inspectArgv(sub, depth, hasHeredoc);
+    }
+  }
+
   if (cmd === "sudo" || cmd === "command" || cmd === "builtin" || cmd === "nohup" || cmd === "time" || cmd === "nice" || cmd === "ionice" || cmd === "stdbuf" || cmd === "timeout") {
     const arity = new Set(["-u", "--user", "-g", "--group", "-p", "-s", "--signal", "-k", "--kill-after", "-o", "-e", "-i"]);
     let next = skipWrapper(rest, arity);
@@ -456,6 +500,11 @@ export function inspectBashCommand(command, depth) {
 
   const segs = splitSegments(tokens);
   for (const seg of segs) {
+    const rawWords = wordsOf(seg);
+    const envHit = checkEnvExfiltration(rawWords, command);
+    if (envHit.deny) {
+      return deny("env-dump-leak", envHit.detail || command);
+    }
     const wordTokens = wordTokensOf(seg);
     const heredocs = seg.filter(function (t) { return t.kind === "heredoc"; });
     const argv = stripPrefixes(wordsOf(seg));

package/lib/messages.js

@@ -182,6 +182,7 @@ const RULE_KEYS = Object.freeze({
   "eval": "ruleEval",
   "nested-shell": "ruleNestedShell",
   "interpreter-payload": "ruleInterpreterPayload",
+  "env-dump-leak": "ruleEnvDumpLeak",
 });
 
 const ASK_KEYS = Object.freeze({

package/lib/paths.js

@@ -1,5 +1,55 @@
 // lib/paths.js
-// Home path expansion and path boundary helpers for dsh-approval-gate.
+// Cross-platform path normalization, home expansion, canonicalization, and path boundary traversal protection for dsh-approval-gate.
+
+const PROTECTED_BASENAMES = new Set([
+  ".bashrc",
+  ".bash_profile",
+  ".bash_login",
+  ".profile",
+  ".zshrc",
+  ".zprofile",
+  ".zshenv",
+  ".cshrc",
+  "cordis.patch.yml",
+]);
+
+/**
+ * Normalizes Windows and POSIX path separators to uniform forward slashes.
+ * Collapses redundant slashes and standardizes Windows drive letters.
+ *
+ * @param {string} p
+ * @returns {string}
+ */
+export function normalizeSeparators(p) {
+  if (typeof p !== "string") return "";
+  let s = p.trim();
+  if (s === "") return "";
+
+  // Check UNC network share (e.g. \\server\share or //server/share)
+  const isUnc = /^([\\/]{2})([^\\/]+)/.test(s);
+
+  // Convert all backslashes to forward slashes
+  s = s.replace(/\\/g, "/");
+
+  // Collapse multiple consecutive slashes
+  if (isUnc) {
+    s = "//" + s.slice(2).replace(/\/+/g, "/");
+  } else {
+    s = s.replace(/\/+/g, "/");
+  }
+
+  // Normalize Windows drive letter: c:/ -> C:/
+  s = s.replace(/^([a-zA-Z]):(\/|$)/, (_, drive, rest) => `${drive.toUpperCase()}:${rest}`);
+
+  // Strip trailing slash unless root / or C:/
+  if (s.length > 1 && s.endsWith("/")) {
+    if (!/^(?:\/|[A-Za-z]:\/)$/.test(s)) {
+      s = s.slice(0, -1);
+    }
+  }
+
+  return s;
+}
 
 /**
  * Expand `~`, `${HOME}`, `$HOME`, and `%USERPROFILE%` at the start of or within a path.
@@ -23,3 +73,198 @@ export function expandHome(p, env = process.env) {
   res = res.replace(/%USERPROFILE%/gi, cleanHome);
   return res;
 }
+
+/**
+ * Canonicalizes a path resolving dot and dot-dot segments without disk I/O.
+ *
+ * @param {string} p
+ * @param {{ env?: Record<string, string|undefined> }} [options]
+ * @returns {string}
+ */
+export function canonicalizeFsPath(p, options = {}) {
+  if (typeof p !== "string") return "";
+  let s = expandHome(p, options.env);
+  s = normalizeSeparators(s);
+  if (!s) return "";
+
+  // Check prefix: / (root), C:/ (Windows root), //server/share (UNC), or relative
+  let prefix = "";
+  if (s.startsWith("//")) {
+    const m = s.match(/^(\/\/[^/]+\/[^/]+)(?:\/|$)/);
+    if (m) {
+      prefix = m[1];
+      s = s.slice(prefix.length);
+    }
+  } else if (/^[A-Za-z]:\//.test(s)) {
+    prefix = s.slice(0, 3);
+    s = s.slice(3);
+  } else if (s.startsWith("/")) {
+    prefix = "/";
+    s = s.slice(1);
+  }
+
+  const rawSegments = s.split("/");
+  const stack = [];
+
+  for (const seg of rawSegments) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") {
+      if (stack.length > 0 && stack[stack.length - 1] !== "..") {
+        stack.pop();
+      } else if (!prefix) {
+        stack.push("..");
+      }
+      // If there is an absolute prefix (e.g. / or C:/), .. at root cannot escape above root
+    } else {
+      stack.push(seg);
+    }
+  }
+
+  const resolvedBody = stack.join("/");
+  if (!prefix) {
+    return resolvedBody || ".";
+  }
+  if (!resolvedBody) {
+    return prefix;
+  }
+  return prefix.endsWith("/") ? `${prefix}${resolvedBody}` : `${prefix}/${resolvedBody}`;
+}
+
+/**
+ * Checks whether a path contains directory traversal sequences attempting to escape baseDir.
+ *
+ * @param {string} p
+ * @param {string} [baseDir]
+ * @returns {boolean}
+ */
+export function isPathTraversal(p, baseDir = "/workspace") {
+  if (typeof p !== "string" || p.trim() === "") return false;
+
+  // Detect null byte injection
+  if (p.includes("\0") || /%00/i.test(p)) return true;
+
+  // Detect encoded traversal sequences
+  if (/(?:%2e|%2f|%5c|\.\.)(?:%2e|%2f|%5c|\.\.)/i.test(p)) return true;
+
+  const normBase = canonicalizeFsPath(baseDir);
+  const isAbsolute = /^(?:\/|[A-Za-z]:\/|\/\/)/.test(normalizeSeparators(p));
+
+  let candidate = "";
+  if (isAbsolute) {
+    candidate = canonicalizeFsPath(p);
+  } else {
+    candidate = canonicalizeFsPath(`${normBase}/${p}`);
+  }
+
+  if (candidate === normBase) return false;
+  return !(candidate.startsWith(normBase.endsWith("/") ? normBase : `${normBase}/`));
+}
+
+/**
+ * Safely resolves a path relative to a base directory, verifying boundaries.
+ *
+ * @param {string} p
+ * @param {string} [baseDir]
+ * @returns {{ safe: boolean, path: string, canonical: string, reason?: string }}
+ */
+export function resolveSafePath(p, baseDir = "/workspace") {
+  if (isPathTraversal(p, baseDir)) {
+    return {
+      safe: false,
+      reason: "path-traversal-escape",
+      path: p,
+      canonical: canonicalizeFsPath(p),
+    };
+  }
+  const normBase = canonicalizeFsPath(baseDir);
+  const isAbsolute = /^(?:\/|[A-Za-z]:\/|\/\/)/.test(normalizeSeparators(p));
+  const resolved = isAbsolute ? canonicalizeFsPath(p) : canonicalizeFsPath(`${normBase}/${p}`);
+  return {
+    safe: true,
+    path: p,
+    canonical: resolved,
+  };
+}
+
+/**
+ * Checks whether a path targets protected system, git, ssh, or secret configuration.
+ *
+ * @param {string} p
+ * @param {Record<string, string|undefined>} [env]
+ * @returns {boolean}
+ */
+export function isProtectedConfigPath(p, env = process.env) {
+  if (typeof p !== "string" || p.trim() === "") return false;
+
+  const expanded = expandHome(p, env);
+  const normalized = canonicalizeFsPath(expanded);
+  const lower = normalized.toLowerCase();
+
+  // 1. .git internal tree
+  if (
+    lower === ".git" ||
+    lower.startsWith(".git/") ||
+    lower.endsWith("/.git") ||
+    lower.includes("/.git/")
+  ) {
+    return true;
+  }
+
+  // 2. .ssh directory and key files
+  if (
+    lower === ".ssh" ||
+    lower.startsWith(".ssh/") ||
+    lower.endsWith("/.ssh") ||
+    lower.includes("/.ssh/")
+  ) {
+    return true;
+  }
+
+  // 3. System auth and security files
+  if (
+    lower === "/etc/sudoers" ||
+    lower.includes("/etc/sudoers.d/") ||
+    lower === "/etc/shadow" ||
+    lower === "/etc/gshadow" ||
+    lower.includes("/etc/pam.d/")
+  ) {
+    return true;
+  }
+
+  // 4. Shell startup files
+  const parts = normalized.split("/");
+  const base = parts[parts.length - 1];
+  const baseLower = base.toLowerCase();
+
+  if (PROTECTED_BASENAMES.has(baseLower)) {
+    return true;
+  }
+
+  // 5. Env files (.env, .env.local, .env.prod)
+  if (baseLower === ".env" || baseLower.startsWith(".env.")) {
+    return true;
+  }
+
+  // 6. Credentials and settings
+  if (/^credentials\.ya?ml$/i.test(base) || /^settings\.ya?ml$/i.test(base)) {
+    return true;
+  }
+
+  // 7. Certificates and keys
+  if (/\.(pem|key|crt|p12|pfx)$/i.test(base)) {
+    return true;
+  }
+
+  // 8. SSH key filenames anywhere
+  if (/^(id_rsa|id_ed25519|id_ecdsa|authorized_keys2?)$/i.test(base)) {
+    return true;
+  }
+
+  // 9. Generic secrets / tokens / passwords
+  if (/(?:^|[._-])(?:secret|token|credential|passwd|api[_-]?key)(?:$|[._-])/i.test(baseLower)) {
+    return true;
+  }
+
+  return false;
+}
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-approval-gate",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Host-only command safety gate for DeepSeek Harness: blocks recognized dangerous operations and requests DSH approval when a command cannot be inspected.",
   "type": "module",
   "main": "lib/index.js",