@goplus/agentguard 1.0.0 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +85 -156
- package/dist/action/detectors/exec.d.ts.map +1 -1
- package/dist/action/detectors/exec.js +97 -7
- package/dist/action/detectors/exec.js.map +1 -1
- package/dist/action/detectors/network.d.ts.map +1 -1
- package/dist/action/detectors/network.js +7 -0
- package/dist/action/detectors/network.js.map +1 -1
- package/dist/action/index.d.ts.map +1 -1
- package/dist/action/index.js +51 -6
- package/dist/action/index.js.map +1 -1
- package/dist/index.d.ts +0 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -4
- package/dist/index.js.map +1 -1
- package/dist/mcp-server.js +45 -1
- package/dist/mcp-server.js.map +1 -1
- package/dist/registry/storage.d.ts.map +1 -1
- package/dist/registry/storage.js +3 -2
- package/dist/registry/storage.js.map +1 -1
- package/dist/scanner/index.d.ts +14 -0
- package/dist/scanner/index.d.ts.map +1 -1
- package/dist/scanner/index.js +86 -21
- package/dist/scanner/index.js.map +1 -1
- package/dist/scanner/rules/exfiltration.js +1 -1
- package/dist/scanner/rules/exfiltration.js.map +1 -1
- package/dist/scanner/rules/index.d.ts.map +1 -1
- package/dist/scanner/rules/index.js +2 -0
- package/dist/scanner/rules/index.js.map +1 -1
- package/dist/scanner/rules/obfuscation.js +1 -1
- package/dist/scanner/rules/obfuscation.js.map +1 -1
- package/dist/scanner/rules/remote-loader.js +1 -1
- package/dist/scanner/rules/remote-loader.js.map +1 -1
- package/dist/scanner/rules/shell-exec.js +2 -2
- package/dist/scanner/rules/shell-exec.js.map +1 -1
- package/dist/scanner/rules/trojan.d.ts +6 -0
- package/dist/scanner/rules/trojan.d.ts.map +1 -0
- package/dist/scanner/rules/trojan.js +100 -0
- package/dist/scanner/rules/trojan.js.map +1 -0
- package/dist/tests/action.test.js +39 -2
- package/dist/tests/action.test.js.map +1 -1
- package/dist/tests/scanner.test.js +20 -2
- package/dist/tests/scanner.test.js.map +1 -1
- package/dist/types/action.d.ts +2 -0
- package/dist/types/action.d.ts.map +1 -1
- package/dist/types/scanner.d.ts +1 -1
- package/dist/types/scanner.d.ts.map +1 -1
- package/dist/types/scanner.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,70 +1,73 @@
|
|
|
1
|
-
|
|
1
|
+
<p align="center">
|
|
2
|
+
<img src="assets/logo.png" alt="GoPlus AgentGuard" width="120" />
|
|
3
|
+
</p>
|
|
2
4
|
|
|
3
|
-
|
|
5
|
+
<h1 align="center">GoPlus AgentGuard</h1>
|
|
4
6
|
|
|
5
|
-
|
|
7
|
+
<p align="center"><b>The essential security guard for every AI agent user.</b></p>
|
|
6
8
|
|
|
9
|
+
<p align="center">Your AI agent has full access to your terminal, files, and secrets — but zero security awareness.<br/>A malicious skill or prompt injection can steal your keys, drain your wallet, or wipe your disk.<br/><b>AgentGuard stops all of that.</b></p>
|
|
10
|
+
|
|
11
|
+
[](https://www.npmjs.com/package/@goplus/agentguard)
|
|
12
|
+
[](https://github.com/GoPlusSecurity/agentguard)
|
|
7
13
|
[](LICENSE)
|
|
8
|
-
[](https://www.typescriptlang.org)
|
|
14
|
+
[](https://github.com/GoPlusSecurity/agentguard/actions/workflows/ci.yml)
|
|
10
15
|
[](https://agentskills.io)
|
|
11
16
|
|
|
12
|
-
##
|
|
13
|
-
|
|
14
|
-
GoPlus AgentGuard protects your AI coding agent with two layers:
|
|
17
|
+
## Why AgentGuard?
|
|
15
18
|
|
|
16
|
-
|
|
17
|
-
- Blocks `rm -rf /`, fork bombs, `curl | bash` and other destructive commands
|
|
18
|
-
- Prevents writes to `.env`, `.ssh/`, credentials files
|
|
19
|
-
- Detects data exfiltration to Discord/Telegram/Slack webhooks
|
|
20
|
-
- Flags requests to high-risk domains
|
|
19
|
+
AI coding agents can execute any command, read any file, and install any skill — with zero security review. The risks are real:
|
|
21
20
|
|
|
22
|
-
**
|
|
23
|
-
-
|
|
24
|
-
-
|
|
25
|
-
- Runtime action evaluation with GoPlus API integration
|
|
26
|
-
- Trust registry for managing skill permissions
|
|
21
|
+
- **Malicious skills** can hide backdoors, steal credentials, or exfiltrate data
|
|
22
|
+
- **Prompt injection** can trick your agent into running destructive commands
|
|
23
|
+
- **Unverified code** from the internet may contain wallet drainers or keyloggers
|
|
27
24
|
|
|
28
|
-
|
|
25
|
+
**AgentGuard is the first real-time security layer for AI agents.** It automatically scans every new skill, blocks dangerous actions before they execute, and tracks which skill initiated each action. One install, always protected.
|
|
29
26
|
|
|
30
|
-
|
|
27
|
+
## What It Does
|
|
31
28
|
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
| **Cursor** | Skill |
|
|
38
|
-
| **GitHub Copilot** | Skill |
|
|
39
|
-
| **Any Agent Skills-compatible agent** | Skill |
|
|
29
|
+
**Layer 1 — Automatic Guard (hooks)**: Install once, always protected.
|
|
30
|
+
- Blocks `rm -rf /`, fork bombs, `curl | bash` and destructive commands
|
|
31
|
+
- Prevents writes to `.env`, `.ssh/`, credentials files
|
|
32
|
+
- Detects data exfiltration to Discord/Telegram/Slack webhooks
|
|
33
|
+
- Tracks which skill initiated each action — holds malicious skills accountable
|
|
40
34
|
|
|
41
|
-
|
|
35
|
+
**Layer 2 — Deep Scan (skill)**: On-demand security audit with 24 detection rules.
|
|
36
|
+
- **Auto-scans new skills** on session start — malicious code blocked before it runs
|
|
37
|
+
- Static analysis for secrets, backdoors, obfuscation, and prompt injection
|
|
38
|
+
- Web3-specific: wallet draining, unlimited approvals, reentrancy, proxy exploits
|
|
39
|
+
- Trust registry with capability-based access control per skill
|
|
42
40
|
|
|
43
41
|
## Quick Start
|
|
44
42
|
|
|
45
|
-
### One-Click Install
|
|
46
|
-
|
|
47
43
|
```bash
|
|
48
|
-
|
|
49
|
-
cd agentguard && ./setup.sh
|
|
44
|
+
npm install @goplus/agentguard
|
|
50
45
|
```
|
|
51
46
|
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
To enable automatic hook protection, add GoPlus AgentGuard as a Claude Code plugin:
|
|
47
|
+
<details>
|
|
48
|
+
<summary><b>Full install with auto-guard hooks (Claude Code)</b></summary>
|
|
55
49
|
|
|
56
50
|
```bash
|
|
51
|
+
git clone https://github.com/GoPlusSecurity/agentguard.git
|
|
52
|
+
cd agentguard && ./setup.sh
|
|
57
53
|
claude plugin add /path/to/agentguard
|
|
58
54
|
```
|
|
59
55
|
|
|
60
|
-
|
|
56
|
+
This installs the skill, configures hooks, and sets your protection level.
|
|
57
|
+
|
|
58
|
+
</details>
|
|
59
|
+
|
|
60
|
+
<details>
|
|
61
|
+
<summary><b>Manual install (skill only)</b></summary>
|
|
61
62
|
|
|
62
63
|
```bash
|
|
63
64
|
git clone https://github.com/GoPlusSecurity/agentguard.git
|
|
64
65
|
cp -r agentguard/skills/agentguard ~/.claude/skills/agentguard
|
|
65
66
|
```
|
|
66
67
|
|
|
67
|
-
|
|
68
|
+
</details>
|
|
69
|
+
|
|
70
|
+
Then use `/agentguard` in your agent:
|
|
68
71
|
|
|
69
72
|
```
|
|
70
73
|
/agentguard scan ./src # Scan code for security risks
|
|
@@ -74,28 +77,6 @@ Then use `/agentguard` in Claude Code:
|
|
|
74
77
|
/agentguard config balanced # Set protection level
|
|
75
78
|
```
|
|
76
79
|
|
|
77
|
-
## How It Works
|
|
78
|
-
|
|
79
|
-
```
|
|
80
|
-
┌──────────────────────────────────────────────────────┐
|
|
81
|
-
│ Layer 1: Auto Guard (hooks — install once, forget) │
|
|
82
|
-
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
|
|
83
|
-
│ │ PreToolUse │ │ PostToolUse │ │ Config │ │
|
|
84
|
-
│ │ Block danger │ │ Audit log │ │ 3 levels │ │
|
|
85
|
-
│ └──────┬───────┘ └──────┬───────┘ └──────┬───────┘ │
|
|
86
|
-
│ └────────┬───────┘ │ │
|
|
87
|
-
│ ▼ │ │
|
|
88
|
-
│ ActionScanner Engine ◄────────────┘ │
|
|
89
|
-
└──────────────────────────────────────────────────────┘
|
|
90
|
-
┌──────────────────────────────────────────────────────┐
|
|
91
|
-
│ Layer 2: Deep Scan (skill — on demand) │
|
|
92
|
-
│ /agentguard scan — 20-rule static analysis │
|
|
93
|
-
│ /agentguard action — Runtime action evaluation │
|
|
94
|
-
│ /agentguard trust — Skill trust management │
|
|
95
|
-
│ /agentguard report — Security event log │
|
|
96
|
-
└──────────────────────────────────────────────────────┘
|
|
97
|
-
```
|
|
98
|
-
|
|
99
80
|
## Protection Levels
|
|
100
81
|
|
|
101
82
|
| Level | Behavior |
|
|
@@ -104,9 +85,7 @@ Then use `/agentguard` in Claude Code:
|
|
|
104
85
|
| `balanced` | Block dangerous, confirm risky. Good for daily use. **(default)** |
|
|
105
86
|
| `permissive` | Only block critical threats. For experienced users who want minimal friction. |
|
|
106
87
|
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
## Detection Rules (20)
|
|
88
|
+
## Detection Rules (24)
|
|
110
89
|
|
|
111
90
|
| Category | Rules | Severity |
|
|
112
91
|
|----------|-------|----------|
|
|
@@ -115,6 +94,7 @@ Change with: `/agentguard config <level>`
|
|
|
115
94
|
| **Exfiltration** | NET_EXFIL_UNRESTRICTED, WEBHOOK_EXFIL | HIGH-CRITICAL |
|
|
116
95
|
| **Obfuscation** | OBFUSCATION, PROMPT_INJECTION | HIGH-CRITICAL |
|
|
117
96
|
| **Web3** | WALLET_DRAINING, UNLIMITED_APPROVAL, DANGEROUS_SELFDESTRUCT, HIDDEN_TRANSFER, PROXY_UPGRADE, FLASH_LOAN_RISK, REENTRANCY_PATTERN, SIGNATURE_REPLAY | MEDIUM-CRITICAL |
|
|
97
|
+
| **Trojan & Social Engineering** | TROJAN_DISTRIBUTION, SUSPICIOUS_PASTE_URL, SUSPICIOUS_IP, SOCIAL_ENGINEERING | MEDIUM-CRITICAL |
|
|
118
98
|
|
|
119
99
|
## Try It
|
|
120
100
|
|
|
@@ -124,112 +104,59 @@ Scan the included vulnerable demo project:
|
|
|
124
104
|
/agentguard scan examples/vulnerable-skill
|
|
125
105
|
```
|
|
126
106
|
|
|
127
|
-
Expected output: **CRITICAL** risk level with
|
|
128
|
-
|
|
129
|
-
## Advanced Usage
|
|
130
|
-
|
|
131
|
-
### As MCP Server
|
|
132
|
-
|
|
133
|
-
```json
|
|
134
|
-
{
|
|
135
|
-
"mcpServers": {
|
|
136
|
-
"agentguard": {
|
|
137
|
-
"command": "npx",
|
|
138
|
-
"args": ["-y", "agentguard"],
|
|
139
|
-
"env": {
|
|
140
|
-
"GOPLUS_API_KEY": "your_key",
|
|
141
|
-
"GOPLUS_API_SECRET": "your_secret"
|
|
142
|
-
}
|
|
143
|
-
}
|
|
144
|
-
}
|
|
145
|
-
}
|
|
146
|
-
```
|
|
147
|
-
|
|
148
|
-
MCP tools: `skill_scanner_scan`, `registry_lookup`, `registry_attest`, `registry_revoke`, `registry_list`, `action_scanner_decide`, `action_scanner_simulate_web3`
|
|
149
|
-
|
|
150
|
-
### As SDK
|
|
107
|
+
Expected output: **CRITICAL** risk level with detection hits across JavaScript, Solidity, and Markdown files.
|
|
151
108
|
|
|
152
|
-
|
|
153
|
-
import { createAgentGuard } from 'agentguard';
|
|
154
|
-
|
|
155
|
-
const { scanner, registry, actionScanner } = createAgentGuard();
|
|
156
|
-
|
|
157
|
-
// Scan code
|
|
158
|
-
const result = await scanner.scan({
|
|
159
|
-
skill: { id: 'my-skill', source: 'github.com/org/skill', version_ref: 'v1.0.0', artifact_hash: '' },
|
|
160
|
-
payload: { type: 'dir', ref: '/path/to/skill' },
|
|
161
|
-
});
|
|
162
|
-
console.log(result.risk_level); // 'low' | 'medium' | 'high' | 'critical'
|
|
163
|
-
|
|
164
|
-
// Evaluate action
|
|
165
|
-
const decision = await actionScanner.decide({
|
|
166
|
-
actor: { skill: { id: 'my-skill', source: 'cli', version_ref: '1.0.0', artifact_hash: '' } },
|
|
167
|
-
action: { type: 'exec_command', data: { command: 'rm -rf /' } },
|
|
168
|
-
context: { session_id: 's1', user_present: true, env: 'prod', time: new Date().toISOString() },
|
|
169
|
-
});
|
|
170
|
-
console.log(decision.decision); // 'deny'
|
|
171
|
-
```
|
|
172
|
-
|
|
173
|
-
### Trust Management
|
|
174
|
-
|
|
175
|
-
```
|
|
176
|
-
/agentguard trust attest --id my-bot --source github.com/org/bot --version v1.0.0 --hash abc --trust-level restricted --preset trading_bot --reviewed-by admin
|
|
177
|
-
/agentguard trust lookup --source github.com/org/bot
|
|
178
|
-
/agentguard trust revoke --source github.com/org/bot --reason "security concern"
|
|
179
|
-
/agentguard trust list --trust-level trusted
|
|
180
|
-
```
|
|
181
|
-
|
|
182
|
-
Presets: `none` | `read_only` | `trading_bot` | `defi`
|
|
109
|
+
## Compatibility
|
|
183
110
|
|
|
184
|
-
|
|
111
|
+
GoPlus AgentGuard follows the [Agent Skills](https://agentskills.io) open standard:
|
|
185
112
|
|
|
186
|
-
|
|
113
|
+
| Platform | Support |
|
|
114
|
+
|----------|---------|
|
|
115
|
+
| **Claude Code** | Full (skill + hooks auto-guard) |
|
|
116
|
+
| **OpenAI Codex CLI** | Skill (scan/action/trust commands) |
|
|
117
|
+
| **Gemini CLI** | Skill |
|
|
118
|
+
| **Cursor** | Skill |
|
|
119
|
+
| **GitHub Copilot** | Skill |
|
|
187
120
|
|
|
188
|
-
|
|
189
|
-
export GOPLUS_API_KEY=your_key
|
|
190
|
-
export GOPLUS_API_SECRET=your_secret
|
|
191
|
-
```
|
|
121
|
+
> Hooks-based auto-guard (Layer 1) is specific to Claude Code's plugin system. The skill commands (Layer 2) work on any Agent Skills-compatible platform.
|
|
192
122
|
|
|
193
|
-
|
|
123
|
+
## Hook Limitations
|
|
194
124
|
|
|
195
|
-
|
|
125
|
+
The auto-guard hooks (Layer 1) have the following constraints:
|
|
196
126
|
|
|
197
|
-
|
|
127
|
+
- **Platform-specific**: Hooks rely on Claude Code's `PreToolUse` / `PostToolUse` / `SessionStart` events. Other platforms do not yet support this hook system.
|
|
128
|
+
- **Default-deny policy**: First-time use may trigger confirmation prompts for certain commands. A built-in safe-command allowlist (`ls`, `echo`, `pwd`, `git status`, etc.) reduces false positives.
|
|
129
|
+
- **Skill source tracking is heuristic**: AgentGuard infers which skill initiated an action by analyzing the conversation transcript. This is not 100% precise in all cases.
|
|
130
|
+
- **Cannot intercept skill installation itself**: Hooks can only intercept tool calls (Bash, Write, WebFetch, etc.) that a skill makes *after* loading — they cannot block the Skill tool invocation itself.
|
|
198
131
|
|
|
199
|
-
|
|
200
|
-
pip install cisco-ai-skill-scanner
|
|
201
|
-
```
|
|
132
|
+
## Roadmap
|
|
202
133
|
|
|
203
|
-
|
|
134
|
+
### v1.1 — Detection Enhancement
|
|
135
|
+
- [x] Extend scanner rules to Markdown files (detect malicious SKILL.md)
|
|
136
|
+
- [x] Base64 payload decoding and re-scanning
|
|
137
|
+
- [x] New rules: TROJAN_DISTRIBUTION, SUSPICIOUS_PASTE_URL, SUSPICIOUS_IP, SOCIAL_ENGINEERING
|
|
138
|
+
- [x] Safe-command allowlist to reduce hook false positives
|
|
139
|
+
- [x] Plugin manifest (`.claude-plugin/`) for one-step install
|
|
204
140
|
|
|
205
|
-
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
│ ├── action-policies.md # Action policy reference
|
|
211
|
-
│ ├── web3-patterns.md # Web3 patterns reference
|
|
212
|
-
│ └── scripts/ # CLI tools (trust-cli, action-cli, guard-hook)
|
|
213
|
-
├── hooks/hooks.json # Plugin hooks configuration
|
|
214
|
-
├── src/ # TypeScript source
|
|
215
|
-
│ ├── scanner/ # 20-rule static analysis engine
|
|
216
|
-
│ ├── action/ # Runtime action evaluator + GoPlus integration
|
|
217
|
-
│ ├── registry/ # Trust level management
|
|
218
|
-
│ ├── policy/ # Default policies and presets
|
|
219
|
-
│ └── tests/ # Test suite
|
|
220
|
-
├── examples/vulnerable-skill/ # Demo project for testing
|
|
221
|
-
├── data/registry.json # Trust registry storage
|
|
222
|
-
├── setup.sh # One-click install script
|
|
223
|
-
└── dist/ # Compiled output
|
|
224
|
-
```
|
|
141
|
+
### v2.0 — Multi-Platform
|
|
142
|
+
- [ ] OpenClaw gateway plugin integration
|
|
143
|
+
- [ ] `before_tool_call` / `after_tool_call` hook wiring
|
|
144
|
+
- [ ] OpenAI Codex CLI sandbox adapter
|
|
145
|
+
- [ ] Federated trust registry across platforms
|
|
225
146
|
|
|
226
|
-
|
|
147
|
+
### v3.0 — Ecosystem
|
|
148
|
+
- [ ] Threat intelligence feed (shared C2 IP/domain blocklist)
|
|
149
|
+
- [ ] Skill marketplace automated scanning pipeline
|
|
150
|
+
- [ ] VS Code extension for IDE-native security
|
|
151
|
+
- [ ] Community rule contributions (open rule format)
|
|
227
152
|
|
|
228
|
-
|
|
229
|
-
npm install && npm run build && npm test
|
|
230
|
-
```
|
|
153
|
+
## Documentation
|
|
231
154
|
|
|
232
|
-
|
|
155
|
+
- [MCP Server Setup](docs/mcp-server.md) — Run as a Model Context Protocol server
|
|
156
|
+
- [SDK Usage](docs/sdk.md) — Use as a TypeScript/JavaScript library
|
|
157
|
+
- [Trust Management](docs/trust-cli.md) — Manage skill trust levels and capability presets
|
|
158
|
+
- [GoPlus API (Web3)](docs/goplus-api.md) — Enhanced Web3 security with GoPlus integration
|
|
159
|
+
- [Architecture](docs/architecture.md) — Project structure and testing
|
|
233
160
|
|
|
234
161
|
## License
|
|
235
162
|
|
|
@@ -239,4 +166,6 @@ npm install && npm run build && npm test
|
|
|
239
166
|
|
|
240
167
|
Contributions welcome! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
|
|
241
168
|
|
|
169
|
+
Found a security vulnerability? See [SECURITY.md](SECURITY.md).
|
|
170
|
+
|
|
242
171
|
Built by [GoPlus Security](https://gopluslabs.io).
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../../src/action/detectors/exec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE7E;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB;IACjB,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,gBAAgB;IAChB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,eAAe;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,mBAAmB;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,mBAAmB;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;
|
|
1
|
+
{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../../src/action/detectors/exec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE7E;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB;IACjB,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,gBAAgB;IAChB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,eAAe;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,mBAAmB;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,mBAAmB;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA0HD;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,eAAe,EACxB,WAAW,GAAE,OAAe,GAC3B,kBAAkB,CA4LpB"}
|
|
@@ -1,6 +1,50 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.analyzeExecCommand = analyzeExecCommand;
|
|
4
|
+
/**
|
|
5
|
+
* Safe read-only commands that should be allowed without restriction.
|
|
6
|
+
* Only applied when the command has no shell metacharacters.
|
|
7
|
+
*/
|
|
8
|
+
const SAFE_COMMAND_PREFIXES = [
|
|
9
|
+
// Basic read-only
|
|
10
|
+
'ls', 'echo', 'pwd', 'whoami', 'date', 'hostname', 'uname',
|
|
11
|
+
'cat', 'head', 'tail', 'wc', 'grep', 'find', 'which', 'type',
|
|
12
|
+
'tree', 'du', 'df', 'sort', 'uniq', 'diff', 'cd',
|
|
13
|
+
// File operations (safe without metacharacters)
|
|
14
|
+
'mkdir', 'cp', 'mv', 'touch',
|
|
15
|
+
// Git (read + common write operations)
|
|
16
|
+
'git status', 'git log', 'git diff', 'git branch', 'git show', 'git remote',
|
|
17
|
+
'git checkout', 'git pull', 'git fetch', 'git merge', 'git add', 'git commit', 'git push',
|
|
18
|
+
// Package managers (run/test/start only — install commands moved to audit list)
|
|
19
|
+
'npm run', 'npm test', 'npm ci', 'npm start',
|
|
20
|
+
'npx', 'yarn', 'pnpm',
|
|
21
|
+
// Version checks
|
|
22
|
+
'node --version', 'node -v', 'npm --version', 'npm -v', 'npx --version',
|
|
23
|
+
'python --version', 'python3 --version', 'pip --version',
|
|
24
|
+
'tsc --version', 'go version', 'rustc --version', 'java -version',
|
|
25
|
+
// Build & run
|
|
26
|
+
'tsc', 'go build', 'go run',
|
|
27
|
+
'cargo build', 'cargo run', 'cargo test',
|
|
28
|
+
'make',
|
|
29
|
+
];
|
|
30
|
+
/**
|
|
31
|
+
* Commands that are not blocked but should be logged with elevated risk
|
|
32
|
+
* (can execute arbitrary code via postinstall scripts, hooks, or setup.py)
|
|
33
|
+
*/
|
|
34
|
+
const AUDIT_COMMAND_PREFIXES = [
|
|
35
|
+
'npm install', 'pip install', 'pip3 install', 'git clone',
|
|
36
|
+
];
|
|
37
|
+
/**
|
|
38
|
+
* Shell metacharacters that disqualify a command from the safe list
|
|
39
|
+
*/
|
|
40
|
+
const SHELL_METACHAR_PATTERN = /[;|&`$(){}<>!#\n\t]/;
|
|
41
|
+
/**
|
|
42
|
+
* Fork bomb patterns (regex-based for variants with spaces)
|
|
43
|
+
*/
|
|
44
|
+
const FORK_BOMB_PATTERNS = [
|
|
45
|
+
/:\s*\(\s*\)\s*\{.*:\s*\|\s*:.*&.*\}/, // :(){ :|:& };: and space variants
|
|
46
|
+
/\bfork\s*bomb\b/i,
|
|
47
|
+
];
|
|
4
48
|
/**
|
|
5
49
|
* Dangerous commands that should always be blocked
|
|
6
50
|
*/
|
|
@@ -9,7 +53,6 @@ const DANGEROUS_COMMANDS = [
|
|
|
9
53
|
'rm -fr',
|
|
10
54
|
'mkfs',
|
|
11
55
|
'dd if=',
|
|
12
|
-
':(){:|:&};:', // Fork bomb
|
|
13
56
|
'chmod 777',
|
|
14
57
|
'chmod -R 777',
|
|
15
58
|
'> /dev/sda',
|
|
@@ -85,22 +128,69 @@ function analyzeExecCommand(command, execAllowed = false) {
|
|
|
85
128
|
let blockReason = execAllowed
|
|
86
129
|
? undefined
|
|
87
130
|
: 'Command execution not allowed';
|
|
88
|
-
// Check for
|
|
89
|
-
for (const
|
|
90
|
-
if (
|
|
131
|
+
// Check for fork bomb patterns (regex-based)
|
|
132
|
+
for (const pattern of FORK_BOMB_PATTERNS) {
|
|
133
|
+
if (pattern.test(fullCommand)) {
|
|
91
134
|
riskTags.push('DANGEROUS_COMMAND');
|
|
92
135
|
evidence.push({
|
|
93
136
|
type: 'dangerous_command',
|
|
94
137
|
field: 'command',
|
|
95
|
-
match:
|
|
96
|
-
description:
|
|
138
|
+
match: 'fork bomb',
|
|
139
|
+
description: 'Fork bomb detected',
|
|
97
140
|
});
|
|
98
141
|
riskLevel = 'critical';
|
|
99
142
|
shouldBlock = true;
|
|
100
|
-
blockReason =
|
|
143
|
+
blockReason = 'Dangerous command: fork bomb';
|
|
101
144
|
break;
|
|
102
145
|
}
|
|
103
146
|
}
|
|
147
|
+
// Check for dangerous commands
|
|
148
|
+
if (riskLevel !== 'critical') {
|
|
149
|
+
for (const dangerous of DANGEROUS_COMMANDS) {
|
|
150
|
+
if (lowerCommand.includes(dangerous.toLowerCase())) {
|
|
151
|
+
riskTags.push('DANGEROUS_COMMAND');
|
|
152
|
+
evidence.push({
|
|
153
|
+
type: 'dangerous_command',
|
|
154
|
+
field: 'command',
|
|
155
|
+
match: dangerous,
|
|
156
|
+
description: `Dangerous command pattern detected: ${dangerous}`,
|
|
157
|
+
});
|
|
158
|
+
riskLevel = 'critical';
|
|
159
|
+
shouldBlock = true;
|
|
160
|
+
blockReason = `Dangerous command: ${dangerous}`;
|
|
161
|
+
break;
|
|
162
|
+
}
|
|
163
|
+
}
|
|
164
|
+
}
|
|
165
|
+
// Safe command check: if not dangerous, no shell metacharacters, and no sensitive paths, allow
|
|
166
|
+
if (riskLevel !== 'critical' && !SHELL_METACHAR_PATTERN.test(fullCommand)) {
|
|
167
|
+
const hasSensitivePath = SENSITIVE_COMMANDS.some(s => lowerCommand.includes(s.toLowerCase()));
|
|
168
|
+
if (!hasSensitivePath) {
|
|
169
|
+
const isSafe = SAFE_COMMAND_PREFIXES.some(prefix => lowerCommand === prefix || lowerCommand.startsWith(prefix + ' '));
|
|
170
|
+
if (isSafe) {
|
|
171
|
+
return {
|
|
172
|
+
risk_level: 'low',
|
|
173
|
+
risk_tags: [],
|
|
174
|
+
evidence: [],
|
|
175
|
+
should_block: false,
|
|
176
|
+
};
|
|
177
|
+
}
|
|
178
|
+
// Audit commands: allow but flag as medium risk (can run arbitrary code via hooks/scripts)
|
|
179
|
+
const isAudit = AUDIT_COMMAND_PREFIXES.some(prefix => lowerCommand === prefix || lowerCommand.startsWith(prefix + ' '));
|
|
180
|
+
if (isAudit) {
|
|
181
|
+
return {
|
|
182
|
+
risk_level: 'medium',
|
|
183
|
+
risk_tags: ['INSTALL_COMMAND'],
|
|
184
|
+
evidence: [{
|
|
185
|
+
type: 'install_command',
|
|
186
|
+
field: 'command',
|
|
187
|
+
description: 'Package install or clone command can execute arbitrary code via hooks',
|
|
188
|
+
}],
|
|
189
|
+
should_block: false,
|
|
190
|
+
};
|
|
191
|
+
}
|
|
192
|
+
}
|
|
193
|
+
}
|
|
104
194
|
// Check for sensitive data access
|
|
105
195
|
for (const sensitive of SENSITIVE_COMMANDS) {
|
|
106
196
|
if (lowerCommand.includes(sensitive.toLowerCase())) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/action/detectors/exec.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/action/detectors/exec.ts"],"names":[],"mappings":";;AA6IA,gDA+LC;AA1TD;;;GAGG;AACH,MAAM,qBAAqB,GAAG;IAC5B,kBAAkB;IAClB,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO;IAC1D,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAC5D,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI;IAChD,gDAAgD;IAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;IAC5B,uCAAuC;IACvC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY;IAC3E,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU;IACzF,gFAAgF;IAChF,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW;IAC5C,KAAK,EAAE,MAAM,EAAE,MAAM;IACrB,iBAAiB;IACjB,gBAAgB,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe;IACvE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe;IACxD,eAAe,EAAE,YAAY,EAAE,iBAAiB,EAAE,eAAe;IACjE,cAAc;IACd,KAAK,EAAE,UAAU,EAAE,QAAQ;IAC3B,aAAa,EAAE,WAAW,EAAE,YAAY;IACxC,MAAM;CACP,CAAC;AAEF;;;GAGG;AACH,MAAM,sBAAsB,GAAG;IAC7B,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW;CAC1D,CAAC;AAEF;;GAEG;AACH,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAErD;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,qCAAqC,EAAK,mCAAmC;IAC7E,kBAAkB;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,WAAW;IACX,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,iBAAiB;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,iBAAiB;IACjB,iBAAiB;IACjB,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,cAAc;IACd,cAAc;IACd,UAAU;IACV,KAAK;IACL,KAAK;CACN,CAAC;AAEF;;GAEG;AACH,MAAM,eAAe,GAAG;IACtB,MAAM;IACN,KAAK;IACL,OAAO;IACP,OAAO;IACP,OAAO;IACP,SAAS;IACT,SAAS;IACT,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,UAAU;IACV,OAAO;IACP,UAAU;IACV,QAAQ;IACR,MAAM;CACP,CAAC;AAEF;;GAEG;AACH,MAAM,gBAAgB,GAAG;IACvB,OAAO;IACP,OAAO;IACP,KAAK;IACL,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;CACR,CAAC;AAEF;;GAEG;AACH,SAAgB,kBAAkB,CAChC,OAAwB,EACxB,cAAuB,KAAK;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI;QAC9B,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAChD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAEpB,MAAM,YAAY,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,IAAI,SAAS,GAA2C,KAAK,CAAC;IAC9D,IAAI,WAAW,GAAG,CAAC,WAAW,CAAC,CAAC,uCAAuC;IACvE,IAAI,WAAW,GAAuB,WAAW;QAC/C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,+BAA+B,CAAC;IAEpC,6CAA6C;IAC7C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,WAAW;gBAClB,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;YACH,SAAS,GAAG,UAAU,CAAC;YACvB,WAAW,GAAG,IAAI,CAAC;YACnB,WAAW,GAAG,8BAA8B,CAAC;YAC7C,MAAM;QACR,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;YAC3C,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACnD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,KAAK,EAAE,SAAS;oBAChB,KAAK,EAAE,SAAS;oBAChB,WAAW,EAAE,uCAAuC,SAAS,EAAE;iBAChE,CAAC,CAAC;gBACH,SAAS,GAAG,UAAU,CAAC;gBACvB,WAAW,GAAG,IAAI,CAAC;gBACnB,WAAW,GAAG,sBAAsB,SAAS,EAAE,CAAC;gBAChD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,IAAI,SAAS,KAAK,UAAU,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1E,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CACjD,YAAY,KAAK,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CACjE,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,UAAU,EAAE,KAAK;oBACjB,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,EAAE;oBACZ,YAAY,EAAE,KAAK;iBACpB,CAAC;YACJ,CAAC;YAED,2FAA2F;YAC3F,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CACnD,YAAY,KAAK,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CACjE,CAAC;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;oBACL,UAAU,EAAE,QAAQ;oBACpB,SAAS,EAAE,CAAC,iBAAiB,CAAC;oBAC9B,QAAQ,EAAE,CAAC;4BACT,IAAI,EAAE,iBAAiB;4BACvB,KAAK,EAAE,SAAS;4BAChB,WAAW,EAAE,uEAAuE;yBACrF,CAAC;oBACF,YAAY,EAAE,KAAK;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,SAAS;gBAChB,WAAW,EAAE,0BAA0B,SAAS,EAAE;aACnD,CAAC,CAAC;YACH,IAAI,SAAS,KAAK,UAAU;gBAAE,SAAS,GAAG,MAAM,CAAC;QACnD,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IACE,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAC1C,YAAY,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,EAC9C,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE;gBACjB,WAAW,EAAE,gCAAgC,GAAG,CAAC,IAAI,EAAE,EAAE;aAC1D,CAAC,CAAC;YACH,IAAI,SAAS,KAAK,KAAK;gBAAE,SAAS,GAAG,QAAQ,CAAC;QAChD,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,IACE,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAC1C,YAAY,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,EAC9C,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE;gBACjB,WAAW,EAAE,oBAAoB,GAAG,CAAC,IAAI,EAAE,EAAE;aAC9C,CAAC,CAAC;YACH,IAAI,SAAS,KAAK,KAAK;gBAAE,SAAS,GAAG,QAAQ,CAAC;QAChD,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,sBAAsB,GAAG;QAC7B,SAAS,EAAO,YAAY;QAC5B,UAAU,EAAM,YAAY;QAC5B,SAAS,EAAO,YAAY;QAC5B,aAAa,EAAG,aAAa;QAC7B,UAAU,EAAM,aAAa;QAC7B,YAAY,EAAI,aAAa;KAC9B,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,SAAS;gBAChB,WAAW,EAAE,uCAAuC;aACrD,CAAC,CAAC;YACH,IAAI,SAAS,KAAK,KAAK;gBAAE,SAAS,GAAG,QAAQ,CAAC;YAC9C,MAAM;QACR,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,gBAAgB,GAAG;YACvB,SAAS;YACT,QAAQ;YACR,UAAU;YACV,OAAO;YACP,SAAS;YACT,YAAY;SACb,CAAC;QAEF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACnC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,GAAG;oBACV,WAAW,EAAE,mCAAmC,GAAG,EAAE;iBACtD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,QAAQ;QACnB,QAAQ;QACR,YAAY,EAAE,WAAW;QACzB,YAAY,EAAE,WAAW;KAC1B,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../../src/action/detectors/network.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIhF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,iBAAiB;IACjB,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,gBAAgB;IAChB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,eAAe;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,mBAAmB;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,mBAAmB;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;
|
|
1
|
+
{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../../src/action/detectors/network.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIhF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,iBAAiB;IACjB,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,gBAAgB;IAChB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,eAAe;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,mBAAmB;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,mBAAmB;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA0CD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,kBAAkB,EAC3B,SAAS,GAAE,MAAM,EAAO,GACvB,qBAAqB,CA6HvB"}
|
|
@@ -18,6 +18,13 @@ const WEBHOOK_DOMAINS = [
|
|
|
18
18
|
'ngrok-free.app',
|
|
19
19
|
'beeceptor.com',
|
|
20
20
|
'mockbin.org',
|
|
21
|
+
'workers.dev',
|
|
22
|
+
'vercel.app',
|
|
23
|
+
'netlify.app',
|
|
24
|
+
'deno.dev',
|
|
25
|
+
'burpcollaborator.net',
|
|
26
|
+
'interact.sh',
|
|
27
|
+
'oast.pro',
|
|
21
28
|
];
|
|
22
29
|
/**
|
|
23
30
|
* Known malicious TLDs (high risk)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"network.js","sourceRoot":"","sources":["../../../src/action/detectors/network.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"network.js","sourceRoot":"","sources":["../../../src/action/detectors/network.ts"],"names":[],"mappings":";;AA+DA,sDAgIC;AA9LD,yDAAyE;AACzE,qDAA6E;AAkB7E;;GAEG;AACH,MAAM,eAAe,GAAG;IACtB,aAAa;IACb,gBAAgB;IAChB,kBAAkB;IAClB,iBAAiB;IACjB,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,UAAU;IACV,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,aAAa;IACb,YAAY;IACZ,aAAa;IACb,UAAU;IACV,sBAAsB;IACtB,aAAa;IACb,UAAU;CACX,CAAC;AAEF;;GAEG;AACH,MAAM,cAAc,GAAG;IACrB,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,OAAO;IACP,QAAQ;IACR,OAAO;CACR,CAAC;AAEF;;GAEG;AACH,SAAgB,qBAAqB,CACnC,OAA2B,EAC3B,YAAsB,EAAE;IAExB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,IAAI,SAAS,GAA2C,KAAK,CAAC;IAC9D,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,WAA+B,CAAC;IAEpC,iBAAiB;IACjB,MAAM,MAAM,GAAG,IAAA,2BAAa,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,CAAC,aAAa,CAAC;YAC1B,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,OAAO,CAAC,GAAG;oBAClB,WAAW,EAAE,qBAAqB;iBACnC;aACF;YACD,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,aAAa;SAC5B,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,MAAM,SAAS,GAAG,IAAA,6BAAe,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAErD,4BAA4B;IAC5B,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAChD,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,yCAAyC,MAAM,EAAE;SAC/D,CAAC,CAAC;QACH,SAAS,GAAG,MAAM,CAAC;QAEnB,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,WAAW,GAAG,IAAI,CAAC;YACnB,WAAW,GAAG,iCAAiC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1E,IAAI,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,wBAAwB;SACtC,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,KAAK;YAAE,SAAS,GAAG,QAAQ,CAAC;IAChD,CAAC;IAED,6BAA6B;IAC7B,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,yBAAyB;SACvC,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,KAAK;YAAE,SAAS,GAAG,QAAQ,CAAC;IAChD,CAAC;IAED,wCAAwC;IACxC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,uDAAuD;QACvD,IAAI,IAAA,wCAAuB,EAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,MAAM;gBACb,WAAW,EAAE,+CAA+C;aAC7D,CAAC,CAAC;YACH,SAAS,GAAG,UAAU,CAAC;YACvB,WAAW,GAAG,IAAI,CAAC;YACnB,WAAW,GAAG,+CAA+C,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,iCAAiC;YACjC,MAAM,UAAU,GAAG,IAAA,iCAAgB,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAE1D,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAEtC,IAAI,UAAU,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;oBACzC,SAAS,GAAG,UAAU,CAAC;oBACvB,WAAW,GAAG,IAAI,CAAC;oBACnB,WAAW,GAAG,0BAA0B,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/E,CAAC;qBAAM,IAAI,UAAU,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;oBAC5C,SAAS,GAAG,MAAM,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,IACE,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;QACvD,CAAC,SAAS;QACV,SAAS,KAAK,QAAQ,EACtB,CAAC;QACD,SAAS,GAAG,MAAM,CAAC;IACrB,CAAC;IAED,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,QAAQ;QACnB,QAAQ;QACR,YAAY,EAAE,WAAW;QACzB,YAAY,EAAE,WAAW;KAC1B,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/action/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EAEd,UAAU,EACV,oBAAoB,EAMrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,OAAO,EAAE,YAAY,EAAgB,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/action/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EAEd,UAAU,EACV,oBAAoB,EAMrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,OAAO,EAAE,YAAY,EAAgB,MAAM,oBAAoB,CAAC;AAIhE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wBAAwB;IACxB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,oBAAoB;IACpB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,yDAAyD;IACzD,mBAAmB,CAAC,EAAE,eAAe,CAAC;CACvC;AAED;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,mBAAmB,CAAkB;gBAEjC,OAAO,GAAE,oBAAyB;IAM9C;;OAEG;IACG,MAAM,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAmE/D;;OAEG;YACW,oBAAoB;IAmElC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAwCzB;;OAEG;YACW,YAAY;IAoK1B;;OAEG;YACW,cAAc;IAiH5B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgE3B;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAgKtE;AAGD,eAAO,MAAM,aAAa,eAAsB,CAAC;AAGjD,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC"}
|
package/dist/action/index.js
CHANGED
|
@@ -10,6 +10,28 @@ var __createBinding = (this && this.__createBinding) || (Object.create ? (functi
|
|
|
10
10
|
if (k2 === undefined) k2 = k;
|
|
11
11
|
o[k2] = m[k];
|
|
12
12
|
}));
|
|
13
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
14
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
15
|
+
}) : function(o, v) {
|
|
16
|
+
o["default"] = v;
|
|
17
|
+
});
|
|
18
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
19
|
+
var ownKeys = function(o) {
|
|
20
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
21
|
+
var ar = [];
|
|
22
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
23
|
+
return ar;
|
|
24
|
+
};
|
|
25
|
+
return ownKeys(o);
|
|
26
|
+
};
|
|
27
|
+
return function (mod) {
|
|
28
|
+
if (mod && mod.__esModule) return mod;
|
|
29
|
+
var result = {};
|
|
30
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
31
|
+
__setModuleDefault(result, mod);
|
|
32
|
+
return result;
|
|
33
|
+
};
|
|
34
|
+
})();
|
|
13
35
|
var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
14
36
|
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
15
37
|
};
|
|
@@ -21,6 +43,7 @@ const network_js_1 = require("./detectors/network.js");
|
|
|
21
43
|
const exec_js_1 = require("./detectors/exec.js");
|
|
22
44
|
const secret_leak_js_1 = require("./detectors/secret-leak.js");
|
|
23
45
|
const client_js_1 = require("./goplus/client.js");
|
|
46
|
+
const nodePath = __importStar(require("path"));
|
|
24
47
|
/**
|
|
25
48
|
* Action Scanner - Module C
|
|
26
49
|
* Runtime action decision engine
|
|
@@ -137,8 +160,12 @@ class ActionScanner {
|
|
|
137
160
|
const execAllowed = capabilities.exec === 'allow';
|
|
138
161
|
const analysis = (0, exec_js_1.analyzeExecCommand)(command, execAllowed);
|
|
139
162
|
if (analysis.should_block) {
|
|
163
|
+
// Critical threats (rm -rf, fork bomb, etc.) are always hard denied.
|
|
164
|
+
// Non-critical blocked commands (exec not allowed but not dangerous)
|
|
165
|
+
// return 'confirm' so balanced mode can prompt the user instead of blocking.
|
|
166
|
+
const isCritical = analysis.risk_level === 'critical';
|
|
140
167
|
return {
|
|
141
|
-
decision: 'deny',
|
|
168
|
+
decision: isCritical ? 'deny' : 'confirm',
|
|
142
169
|
risk_level: analysis.risk_level,
|
|
143
170
|
risk_tags: analysis.risk_tags,
|
|
144
171
|
evidence: analysis.evidence,
|
|
@@ -445,20 +472,38 @@ class ActionScanner {
|
|
|
445
472
|
* Handle file operations
|
|
446
473
|
*/
|
|
447
474
|
handleFileOperation(file, type, capabilities) {
|
|
448
|
-
//
|
|
475
|
+
// Normalize path to prevent traversal attacks (e.g. ./allowed/../../../etc/passwd)
|
|
476
|
+
const normalizedPath = nodePath.normalize(file.path);
|
|
477
|
+
if (normalizedPath !== file.path && file.path.includes('..')) {
|
|
478
|
+
return {
|
|
479
|
+
decision: 'deny',
|
|
480
|
+
risk_level: 'high',
|
|
481
|
+
risk_tags: ['PATH_TRAVERSAL'],
|
|
482
|
+
evidence: [
|
|
483
|
+
{
|
|
484
|
+
type: 'path_traversal',
|
|
485
|
+
field: 'path',
|
|
486
|
+
match: file.path,
|
|
487
|
+
description: `Path traversal detected: "${file.path}" resolves to "${normalizedPath}"`,
|
|
488
|
+
},
|
|
489
|
+
],
|
|
490
|
+
explanation: 'Path traversal attack blocked',
|
|
491
|
+
};
|
|
492
|
+
}
|
|
493
|
+
// Check if path is in allowlist (use normalized path)
|
|
449
494
|
const isAllowed = capabilities.filesystem_allowlist.some((pattern) => {
|
|
450
495
|
if (pattern === '*')
|
|
451
496
|
return true;
|
|
452
497
|
if (pattern.endsWith('/**')) {
|
|
453
498
|
const prefix = pattern.slice(0, -3);
|
|
454
|
-
return
|
|
499
|
+
return normalizedPath.startsWith(prefix);
|
|
455
500
|
}
|
|
456
501
|
if (pattern.endsWith('/*')) {
|
|
457
502
|
const prefix = pattern.slice(0, -2);
|
|
458
|
-
const remainder =
|
|
459
|
-
return
|
|
503
|
+
const remainder = normalizedPath.slice(prefix.length);
|
|
504
|
+
return normalizedPath.startsWith(prefix) && !remainder.includes('/');
|
|
460
505
|
}
|
|
461
|
-
return
|
|
506
|
+
return normalizedPath === pattern || normalizedPath.startsWith(pattern + '/');
|
|
462
507
|
});
|
|
463
508
|
if (isAllowed) {
|
|
464
509
|
return {
|