@myassis/gateway 1.0.45 → 1.0.46
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/services/tools/exec.js +35 -5
- package/package.json +1 -1
|
@@ -69,6 +69,39 @@ exports.clearSessionCwd = clearSessionCwd;
|
|
|
69
69
|
function generateApprovalToken() {
|
|
70
70
|
return crypto_1.default.randomBytes(16).toString('hex');
|
|
71
71
|
}
|
|
72
|
+
function tokenizeCommand(command) {
|
|
73
|
+
return command.match(/"[^"]*"|'[^']*'|&&|\|\||[;&|\r\n]|\S+/g) ?? [];
|
|
74
|
+
}
|
|
75
|
+
function buildCommandSafetyView(command) {
|
|
76
|
+
const textCommands = new Set(['echo', 'findstr', 'grep']);
|
|
77
|
+
const separators = new Set(['&&', '||', '&', '|', ';', '\r', '\n']);
|
|
78
|
+
const tokens = tokenizeCommand(command);
|
|
79
|
+
const view = [];
|
|
80
|
+
let skipTextArgs = false;
|
|
81
|
+
const getCommandName = (token) => {
|
|
82
|
+
const normalized = token
|
|
83
|
+
.replace(/^["']|["']$/g, '')
|
|
84
|
+
.replace(/\\/g, '/')
|
|
85
|
+
.toLowerCase();
|
|
86
|
+
return (normalized.split('/').pop() ?? normalized)
|
|
87
|
+
.replace(/\.(exe|cmd|bat|ps1|sh)$/i, '');
|
|
88
|
+
};
|
|
89
|
+
for (const token of tokens) {
|
|
90
|
+
if (separators.has(token)) {
|
|
91
|
+
view.push(token);
|
|
92
|
+
skipTextArgs = false;
|
|
93
|
+
continue;
|
|
94
|
+
}
|
|
95
|
+
if (skipTextArgs) {
|
|
96
|
+
continue;
|
|
97
|
+
}
|
|
98
|
+
view.push(token);
|
|
99
|
+
if (textCommands.has(getCommandName(token))) {
|
|
100
|
+
skipTextArgs = true;
|
|
101
|
+
}
|
|
102
|
+
}
|
|
103
|
+
return view.join(' ');
|
|
104
|
+
}
|
|
72
105
|
/** 检查命令是否危险 */
|
|
73
106
|
function isDangerousCommand(command) {
|
|
74
107
|
// 命令分隔符（起始位置、空格、shell 操作符）隔离的危险关键字
|
|
@@ -81,11 +114,8 @@ function isDangerousCommand(command) {
|
|
|
81
114
|
/(^|[\s;|&])mkfs\b/i,
|
|
82
115
|
/(^|[\s;|&])dd\s+if=.*of=\/dev\//i,
|
|
83
116
|
];
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
return true;
|
|
87
|
-
}
|
|
88
|
-
return false;
|
|
117
|
+
const safetyCommand = buildCommandSafetyView(command);
|
|
118
|
+
return dangerousPatterns.some(pattern => pattern.test(safetyCommand));
|
|
89
119
|
}
|
|
90
120
|
/** 添加待批准命令，返回 token */
|
|
91
121
|
function addPendingApproval(command, cwd, timeout, sessionId) {
|