@remnux/mcp-server 0.1.23 → 0.1.24
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -563,10 +563,16 @@ All three connection modes (docker, ssh, local) execute commands inside a dispos
|
|
|
563
563
|
- Path traversal inside REMnux (nothing sensitive to protect)
|
|
564
564
|
|
|
565
565
|
**Blocked command patterns (anti-injection):**
|
|
566
|
-
-
|
|
567
|
-
- Shell escape: `eval`, `exec`, backticks, `$()`, `${}`,
|
|
566
|
+
- Null bytes (truncate paths in C functions)
|
|
567
|
+
- Shell escape: `eval`, `exec`, backticks, `$()`, `${}`, process substitution `<()` `>()`
|
|
568
568
|
- Shell sourcing: `source`
|
|
569
569
|
|
|
570
|
+
**Deliberately NOT blocked (legitimate shell syntax):**
|
|
571
|
+
- Simple `$VAR` references (needed for shell loops: `for f in *; do file "$f"; done`)
|
|
572
|
+
- Newlines/carriage returns (enables multi-line scripts; container isolation is the security boundary)
|
|
573
|
+
|
|
574
|
+
The threat is command *substitution* (`$()`, `${}`), not variable *reference* (`$var`) or multi-command execution.
|
|
575
|
+
|
|
570
576
|
**Dangerous pipe patterns (blocked):**
|
|
571
577
|
- Pipes to interpreters: `| sh`, `| bash`, `| zsh`, `| fish`, `| python`, `| perl`, `| ruby`, `| node`, `| php`, `| lua`
|
|
572
578
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"blocklist.d.ts","sourceRoot":"","sources":["../../src/security/blocklist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,gBAAgB,EAAE,cAAc,
|
|
1
|
+
{"version":3,"file":"blocklist.d.ts","sourceRoot":"","sources":["../../src/security/blocklist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,gBAAgB,EAAE,cAAc,EA0B5C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAmCjE;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAMnC;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAc,EAWnD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAqBhF"}
|
|
@@ -16,15 +16,17 @@
|
|
|
16
16
|
import { normalize, isAbsolute, resolve } from "path";
|
|
17
17
|
import { lstatSync, existsSync } from "fs";
|
|
18
18
|
export const BLOCKED_PATTERNS = [
|
|
19
|
-
//
|
|
20
|
-
|
|
19
|
+
// Null byte injection - truncates paths in C-based functions
|
|
20
|
+
// Newlines allowed: enables multi-line scripts; container isolation is security boundary
|
|
21
|
+
{ pattern: /\x00/, category: "null byte injection" },
|
|
21
22
|
// Shell escape / code execution — prevents prompt injection from triggering arbitrary code
|
|
22
23
|
{ pattern: /\beval\b/i, category: "shell escape" },
|
|
23
24
|
{ pattern: /\bexec\b/i, category: "shell escape" },
|
|
24
25
|
{ pattern: /`[^`]+`/, category: "shell escape (backtick)" },
|
|
25
26
|
{ pattern: /\$\([^)]+\)/, category: "shell escape (command substitution)" },
|
|
26
27
|
{ pattern: /\$\{[^}]+\}/, category: "shell escape (variable expansion)" },
|
|
27
|
-
|
|
28
|
+
// Note: Simple $var (like $f in for-loops) is intentionally NOT blocked
|
|
29
|
+
// The threat is command substitution ($(), ${}), not variable reference
|
|
28
30
|
{ pattern: /\$[0-9?$!@#]/, category: "shell escape (special variable)" },
|
|
29
31
|
// Process substitution
|
|
30
32
|
{ pattern: /[<>]\s*\(/, category: "process substitution" },
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"blocklist.js","sourceRoot":"","sources":["../../src/security/blocklist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAW3C,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,
|
|
1
|
+
{"version":3,"file":"blocklist.js","sourceRoot":"","sources":["../../src/security/blocklist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAW3C,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,6DAA6D;IAC7D,yFAAyF;IACzF,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IAEpD,2FAA2F;IAC3F,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE;IAClD,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE;IAClD,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,yBAAyB,EAAE;IAC3D,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,qCAAqC,EAAE;IAC3E,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,mCAAmC,EAAE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,iCAAiC,EAAE;IAExE,uBAAuB;IACvB,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,sBAAsB,EAAE;IAE1D,iBAAiB;IACjB,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE;IAEpD,6FAA6F;IAC7F,iFAAiF;IACjF,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,kCAAkC,EAAE;IACjF,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,kCAAkC,EAAE;IAC/E,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,0CAA0C,EAAE;CAC9E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe;IACtD,mDAAmD;IACnD,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAE9B,8DAA8D;IAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,wBAAwB;IACxB,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnC,qDAAqD;IACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,0DAA0D;IAC1D,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE7C,mCAAmC;IACnC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,6DAA6D;IAC7D,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAEvC,kFAAkF;IAClF,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnF,gDAAgD;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC,uDAAuD;IACvD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,cAAc,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,OAAe;IAEf,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAqB;IACvD,sFAAsF;IACtF,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,eAAe,EAAE;IACzD,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE;IACrD,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE;IACtD,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IACnE,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IAC5D,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IAC5D,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IAC5D,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IAC3D,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,qBAAqB,EAAE;CAC5D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,2CAA2C;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACjD,CAAC;IAED,iCAAiC;IACjC,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,QAAQ,EAAE,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,uBAAuB,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,QAAQ,EAAE,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}
|