@n0zer0d4y/vulcan-file-ops 1.1.6 → 1.1.7

package/CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.7] - 2025-11-18
+
+### Security
+
+- **CRITICAL**: Fixed command approval bypass vulnerability in `execute_shell` tool
+  - Previously, unapproved commands could execute if they didn't match dangerous patterns and `requiresApproval` was not set
+  - Now enforces strict whitelist: ALL commands must be in `--approved-commands` list to execute
+  - Affected commands that were incorrectly allowed: `dir`, `whoami`, `ipconfig`, `type`, `copy`, `move`, `ren`, `del`, `mkdir`, `rmdir`
+  - Added defense-in-depth: dangerous patterns now checked even on approved commands
+  - Enhanced error messages showing approved vs unapproved commands with helpful guidance
+
+### Added
+
+- 19 comprehensive security tests for strict command whitelist enforcement
+  - Tests for unapproved non-dangerous commands (whoami, hostname)
+  - Tests for Windows-specific commands (dir, type, copy, move, ren, del, mkdir, rmdir, ipconfig)
+  - Regression tests ensuring all vulnerability examples are blocked
+  - Defense-in-depth tests for dangerous patterns on approved commands
+
+### Changed
+
+- Updated 9 existing shell-tool tests to reflect new strict approval logic
+- Updated error messages from "Command requires approval" to "Command not in approved list"
+- Shell command path validation tests now include all necessary commands in approved list
+
+### Fixed
+
+- `execute_shell` tool now properly blocks ALL unapproved commands regardless of `requiresApproval` parameter
+- Closed security bypass where unapproved commands executed with default `requiresApproval=false`
+
 ## [1.1.6] - 2025-11-16
 
 ### Fixed

package/dist/tools/shell-tool.js

@@ -114,16 +114,26 @@ export async function handleShellTool(name, args) {
     // Extract root commands for approval checking
     const rootCommands = extractRootCommands(validatedArgs.command);
     const allApproved = rootCommands.every((cmd) => approvedCommands.has(cmd) || alwaysApprovedCommands.has(cmd));
-    // Check for dangerous patterns
-    const isDangerous = isDangerousCommand(validatedArgs.command);
-    if (!allApproved && (validatedArgs.requiresApproval || isDangerous)) {
+    // SECURITY FIX: Block ALL unapproved commands immediately
+    // Previously, commands were only blocked if (!allApproved && (requiresApproval || isDangerous))
+    // This allowed unapproved non-dangerous commands to execute by default
+    if (!allApproved) {
         const unapprovedCommands = rootCommands.filter((cmd) => !approvedCommands.has(cmd) && !alwaysApprovedCommands.has(cmd));
-        throw new Error(`Command requires approval. Unapproved commands: ${unapprovedCommands.join(", ")}\n` +
+        const approvedList = Array.from(approvedCommands).join(", ");
+        throw new Error(`Access denied: Command not in approved list.\n` +
+            `Unapproved commands: ${unapprovedCommands.join(", ")}\n` +
+            `Command: ${validatedArgs.command}\n\n` +
+            `Approved commands: ${approvedList || "(none configured)"}\n\n` +
+            `To execute this command, add it to --approved-commands configuration.`);
+    }
+    // SECURITY: Check dangerous patterns even for approved commands
+    // This provides defense-in-depth against accidentally approving dangerous commands
+    const isDangerous = isDangerousCommand(validatedArgs.command);
+    if (isDangerous && !validatedArgs.requiresApproval) {
+        throw new Error(`⚠️  Dangerous command pattern detected.\n` +
             `Command: ${validatedArgs.command}\n` +
-            `${isDangerous
-                ? "⚠️  Warning: This command matches dangerous patterns\n"
-                : ""}` +
-            `To approve, add these commands to --approved-commands or .env configuration.`);
+            `This command requires explicit approval.\n` +
+            `Set requiresApproval: true in the command arguments to proceed.`);
     }
     // SECURITY FIX: Validate working directory ALWAYS (not just if provided)
     // This prevents bypass via process.cwd() when workdir is omitted
@@ -150,7 +160,7 @@ export async function handleShellTool(name, args) {
             `Error: ${error instanceof Error ? error.message : String(error)}\n` +
             `\n` +
             `Allowed directories:\n` +
-            allowedDirs.map(d => `  - ${d}`).join('\n') +
+            allowedDirs.map((d) => `  - ${d}`).join("\n") +
             `\n\n` +
             `To execute commands in this directory:\n` +
             `  1. Register the directory using register_directory tool, OR\n` +
@@ -165,7 +175,7 @@ export async function handleShellTool(name, args) {
             if (allowedDirs.length === 0) {
                 throw new Error(`Access denied: Command contains paths but no allowed directories are configured.\n` +
                     `Extracted paths:\n` +
-                    extractedPaths.map(p => `  - ${p}`).join('\n') +
+                    extractedPaths.map((p) => `  - ${p}`).join("\n") +
                     `\n\nPlease configure allowed directories using --approved-folders or register_directory tool.`);
             }
             // Validate each extracted path
@@ -177,9 +187,9 @@ export async function handleShellTool(name, args) {
             }
             if (invalidPaths.length > 0) {
                 throw new Error(`Access denied: Command contains paths outside allowed directories:\n` +
-                    invalidPaths.map(p => `  - ${p}`).join('\n') +
+                    invalidPaths.map((p) => `  - ${p}`).join("\n") +
                     `\n\nAllowed directories:\n` +
-                    allowedDirs.map(d => `  - ${d}`).join('\n') +
+                    allowedDirs.map((d) => `  - ${d}`).join("\n") +
                     `\n\nTo access these paths, register their parent directories using register_directory tool.`);
             }
         }
@@ -187,7 +197,7 @@ export async function handleShellTool(name, args) {
     catch (error) {
         // If path extraction fails, be conservative and block
         // (better to block than allow potentially unsafe commands)
-        if (error instanceof Error && error.message.includes('Access denied')) {
+        if (error instanceof Error && error.message.includes("Access denied")) {
             throw error;
         }
         // For extraction errors, block the command to be safe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@n0zer0d4y/vulcan-file-ops",
-  "version": "1.1.6",
+  "version": "1.1.7",
   "mcpName": "io.github.n0zer0d4y/vulcan-file-ops",
   "description": "MCP server for AI assistants: read, write, edit, and manage files securely on local filesystem.",
   "license": "MIT",