@node9/proxy 1.8.2 → 1.8.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +50 -718
- package/dist/cli.js +193 -68
- package/dist/cli.mjs +185 -60
- package/dist/index.js +1 -3
- package/dist/index.mjs +1 -3
- package/dist/shields/builtin/docker.json +120 -0
- package/dist/shields/builtin/k8s.json +92 -0
- package/dist/shields/builtin/mongodb.json +78 -0
- package/dist/shields/builtin/redis.json +78 -0
- package/package.json +1 -1
|
@@ -0,0 +1,92 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "k8s",
|
|
3
|
+
"description": "Protects Kubernetes clusters from destructive AI operations",
|
|
4
|
+
"aliases": ["kubernetes", "kubectl"],
|
|
5
|
+
"smartRules": [
|
|
6
|
+
{
|
|
7
|
+
"name": "shield:k8s:block-delete-namespace",
|
|
8
|
+
"tool": "*",
|
|
9
|
+
"conditions": [
|
|
10
|
+
{
|
|
11
|
+
"field": "command",
|
|
12
|
+
"op": "matches",
|
|
13
|
+
"value": "kubectl\\s+delete\\s+(ns|namespace)\\s+",
|
|
14
|
+
"flags": "i"
|
|
15
|
+
}
|
|
16
|
+
],
|
|
17
|
+
"verdict": "block",
|
|
18
|
+
"reason": "Deleting a namespace destroys all resources inside it — blocked by k8s shield"
|
|
19
|
+
},
|
|
20
|
+
{
|
|
21
|
+
"name": "shield:k8s:block-delete-all",
|
|
22
|
+
"tool": "*",
|
|
23
|
+
"conditions": [
|
|
24
|
+
{
|
|
25
|
+
"field": "command",
|
|
26
|
+
"op": "matches",
|
|
27
|
+
"value": "kubectl\\s+delete\\s+.*--all\\b",
|
|
28
|
+
"flags": "i"
|
|
29
|
+
}
|
|
30
|
+
],
|
|
31
|
+
"verdict": "block",
|
|
32
|
+
"reason": "kubectl delete --all is irreversible — blocked by k8s shield"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"name": "shield:k8s:block-helm-uninstall",
|
|
36
|
+
"tool": "*",
|
|
37
|
+
"conditions": [
|
|
38
|
+
{
|
|
39
|
+
"field": "command",
|
|
40
|
+
"op": "matches",
|
|
41
|
+
"value": "helm\\s+(uninstall|delete|del)\\s+",
|
|
42
|
+
"flags": "i"
|
|
43
|
+
}
|
|
44
|
+
],
|
|
45
|
+
"verdict": "block",
|
|
46
|
+
"reason": "helm uninstall removes a release and its resources — blocked by k8s shield"
|
|
47
|
+
},
|
|
48
|
+
{
|
|
49
|
+
"name": "shield:k8s:review-scale-zero",
|
|
50
|
+
"tool": "*",
|
|
51
|
+
"conditions": [
|
|
52
|
+
{
|
|
53
|
+
"field": "command",
|
|
54
|
+
"op": "matches",
|
|
55
|
+
"value": "kubectl\\s+scale\\s+.*--replicas=0",
|
|
56
|
+
"flags": "i"
|
|
57
|
+
}
|
|
58
|
+
],
|
|
59
|
+
"verdict": "review",
|
|
60
|
+
"reason": "Scaling to zero takes down a workload and requires human approval (k8s shield)"
|
|
61
|
+
},
|
|
62
|
+
{
|
|
63
|
+
"name": "shield:k8s:review-delete-deployment",
|
|
64
|
+
"tool": "*",
|
|
65
|
+
"conditions": [
|
|
66
|
+
{
|
|
67
|
+
"field": "command",
|
|
68
|
+
"op": "matches",
|
|
69
|
+
"value": "kubectl\\s+delete\\s+(deployment|deploy|statefulset|sts|daemonset|ds)\\s+",
|
|
70
|
+
"flags": "i"
|
|
71
|
+
}
|
|
72
|
+
],
|
|
73
|
+
"verdict": "review",
|
|
74
|
+
"reason": "Deleting a workload requires human approval (k8s shield)"
|
|
75
|
+
},
|
|
76
|
+
{
|
|
77
|
+
"name": "shield:k8s:review-apply-force",
|
|
78
|
+
"tool": "*",
|
|
79
|
+
"conditions": [
|
|
80
|
+
{
|
|
81
|
+
"field": "command",
|
|
82
|
+
"op": "matches",
|
|
83
|
+
"value": "kubectl\\s+(apply|replace)\\s+.*--force",
|
|
84
|
+
"flags": "i"
|
|
85
|
+
}
|
|
86
|
+
],
|
|
87
|
+
"verdict": "review",
|
|
88
|
+
"reason": "Force-apply overwrites live resources and requires human approval (k8s shield)"
|
|
89
|
+
}
|
|
90
|
+
],
|
|
91
|
+
"dangerousWords": []
|
|
92
|
+
}
|
|
@@ -0,0 +1,78 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "mongodb",
|
|
3
|
+
"description": "Protects MongoDB databases from destructive AI operations",
|
|
4
|
+
"aliases": ["mongo"],
|
|
5
|
+
"smartRules": [
|
|
6
|
+
{
|
|
7
|
+
"name": "shield:mongodb:block-drop-database",
|
|
8
|
+
"tool": "*",
|
|
9
|
+
"conditions": [
|
|
10
|
+
{
|
|
11
|
+
"field": "command",
|
|
12
|
+
"op": "matches",
|
|
13
|
+
"value": "\\.dropDatabase\\s*\\(",
|
|
14
|
+
"flags": "i"
|
|
15
|
+
}
|
|
16
|
+
],
|
|
17
|
+
"verdict": "block",
|
|
18
|
+
"reason": "dropDatabase is irreversible — blocked by MongoDB shield"
|
|
19
|
+
},
|
|
20
|
+
{
|
|
21
|
+
"name": "shield:mongodb:block-drop-collection",
|
|
22
|
+
"tool": "*",
|
|
23
|
+
"conditions": [
|
|
24
|
+
{
|
|
25
|
+
"field": "command",
|
|
26
|
+
"op": "matches",
|
|
27
|
+
"value": "\\.drop\\s*\\(|db\\.getCollection\\([^)]+\\)\\.drop\\s*\\(",
|
|
28
|
+
"flags": "i"
|
|
29
|
+
}
|
|
30
|
+
],
|
|
31
|
+
"verdict": "block",
|
|
32
|
+
"reason": "Collection drop is irreversible — blocked by MongoDB shield"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"name": "shield:mongodb:block-delete-many-empty-filter",
|
|
36
|
+
"tool": "*",
|
|
37
|
+
"conditions": [
|
|
38
|
+
{
|
|
39
|
+
"field": "command",
|
|
40
|
+
"op": "matches",
|
|
41
|
+
"value": "\\.deleteMany\\s*\\(\\s*\\{\\s*\\}\\s*\\)",
|
|
42
|
+
"flags": "i"
|
|
43
|
+
}
|
|
44
|
+
],
|
|
45
|
+
"verdict": "block",
|
|
46
|
+
"reason": "deleteMany({}) with empty filter wipes the entire collection — blocked by MongoDB shield"
|
|
47
|
+
},
|
|
48
|
+
{
|
|
49
|
+
"name": "shield:mongodb:review-delete-many",
|
|
50
|
+
"tool": "*",
|
|
51
|
+
"conditions": [
|
|
52
|
+
{
|
|
53
|
+
"field": "command",
|
|
54
|
+
"op": "matches",
|
|
55
|
+
"value": "\\.deleteMany\\s*\\(",
|
|
56
|
+
"flags": "i"
|
|
57
|
+
}
|
|
58
|
+
],
|
|
59
|
+
"verdict": "review",
|
|
60
|
+
"reason": "deleteMany requires human approval (MongoDB shield)"
|
|
61
|
+
},
|
|
62
|
+
{
|
|
63
|
+
"name": "shield:mongodb:review-drop-index",
|
|
64
|
+
"tool": "*",
|
|
65
|
+
"conditions": [
|
|
66
|
+
{
|
|
67
|
+
"field": "command",
|
|
68
|
+
"op": "matches",
|
|
69
|
+
"value": "\\.dropIndex\\s*\\(|\\.dropIndexes\\s*\\(",
|
|
70
|
+
"flags": "i"
|
|
71
|
+
}
|
|
72
|
+
],
|
|
73
|
+
"verdict": "review",
|
|
74
|
+
"reason": "Index drops affect query performance and require human approval (MongoDB shield)"
|
|
75
|
+
}
|
|
76
|
+
],
|
|
77
|
+
"dangerousWords": ["dropDatabase", "dropCollection", "mongodrop"]
|
|
78
|
+
}
|
|
@@ -0,0 +1,78 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "redis",
|
|
3
|
+
"description": "Protects Redis instances from destructive AI operations",
|
|
4
|
+
"aliases": [],
|
|
5
|
+
"smartRules": [
|
|
6
|
+
{
|
|
7
|
+
"name": "shield:redis:block-flushall",
|
|
8
|
+
"tool": "*",
|
|
9
|
+
"conditions": [
|
|
10
|
+
{
|
|
11
|
+
"field": "command",
|
|
12
|
+
"op": "matches",
|
|
13
|
+
"value": "\\bFLUSHALL\\b",
|
|
14
|
+
"flags": "i"
|
|
15
|
+
}
|
|
16
|
+
],
|
|
17
|
+
"verdict": "block",
|
|
18
|
+
"reason": "FLUSHALL deletes every key in every database — blocked by Redis shield"
|
|
19
|
+
},
|
|
20
|
+
{
|
|
21
|
+
"name": "shield:redis:block-flushdb",
|
|
22
|
+
"tool": "*",
|
|
23
|
+
"conditions": [
|
|
24
|
+
{
|
|
25
|
+
"field": "command",
|
|
26
|
+
"op": "matches",
|
|
27
|
+
"value": "\\bFLUSHDB\\b",
|
|
28
|
+
"flags": "i"
|
|
29
|
+
}
|
|
30
|
+
],
|
|
31
|
+
"verdict": "block",
|
|
32
|
+
"reason": "FLUSHDB deletes all keys in the current database — blocked by Redis shield"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"name": "shield:redis:block-config-resetstat",
|
|
36
|
+
"tool": "*",
|
|
37
|
+
"conditions": [
|
|
38
|
+
{
|
|
39
|
+
"field": "command",
|
|
40
|
+
"op": "matches",
|
|
41
|
+
"value": "\\bCONFIG\\s+RESETSTAT\\b",
|
|
42
|
+
"flags": "i"
|
|
43
|
+
}
|
|
44
|
+
],
|
|
45
|
+
"verdict": "block",
|
|
46
|
+
"reason": "CONFIG RESETSTAT resets server statistics irreversibly — blocked by Redis shield"
|
|
47
|
+
},
|
|
48
|
+
{
|
|
49
|
+
"name": "shield:redis:review-config-set",
|
|
50
|
+
"tool": "*",
|
|
51
|
+
"conditions": [
|
|
52
|
+
{
|
|
53
|
+
"field": "command",
|
|
54
|
+
"op": "matches",
|
|
55
|
+
"value": "\\bCONFIG\\s+SET\\b",
|
|
56
|
+
"flags": "i"
|
|
57
|
+
}
|
|
58
|
+
],
|
|
59
|
+
"verdict": "review",
|
|
60
|
+
"reason": "CONFIG SET changes live server configuration and requires human approval (Redis shield)"
|
|
61
|
+
},
|
|
62
|
+
{
|
|
63
|
+
"name": "shield:redis:review-del-wildcard",
|
|
64
|
+
"tool": "*",
|
|
65
|
+
"conditions": [
|
|
66
|
+
{
|
|
67
|
+
"field": "command",
|
|
68
|
+
"op": "matches",
|
|
69
|
+
"value": "\\bDEL\\b.*[*?\\[]|redis-cli.*--scan.*\\|.*xargs.*del",
|
|
70
|
+
"flags": "i"
|
|
71
|
+
}
|
|
72
|
+
],
|
|
73
|
+
"verdict": "review",
|
|
74
|
+
"reason": "Wildcard key deletion requires human approval (Redis shield)"
|
|
75
|
+
}
|
|
76
|
+
],
|
|
77
|
+
"dangerousWords": ["FLUSHALL", "FLUSHDB"]
|
|
78
|
+
}
|