@solongate/proxy 0.20.0 → 0.21.0

package/hooks/guard.mjs

@@ -562,6 +562,33 @@ process.stdin.on('end', async () => {
       await blockSelfProtection('SOLONGATE: Heredoc to interpreter — blocked');
     }
 
+    // 7-pre3. Command substitution + destructive = BLOCK
+    // Catches: rm -rf $(node scan.mjs), rm `node scan.mjs`, rm $(bash scan.sh)
+    // Pattern: destructive command + $() or `` containing interpreter call
+    const hasDestructive = /\b(?:rm|rmdir|del|unlink|mv|move|rename|shred)\b/i.test(fullCmd);
+    const hasCmdSubInterpreter = /\$\(\s*(?:node|bash|sh|python[23]?|perl|ruby)\b/i.test(fullCmd)
+      || /`\s*(?:node|bash|sh|python[23]?|perl|ruby)\b/i.test(fullCmd);
+    if (hasDestructive && hasCmdSubInterpreter) {
+      await blockSelfProtection('SOLONGATE: Command substitution + destructive op — blocked');
+    }
+
+    // 7-pre4. Pipe from interpreter to destructive loop = BLOCK
+    // Catches: node scan.mjs | while read d; do rm -rf "$d"; done
+    //          node scan.mjs | xargs rm -rf
+    //          bash scan.sh | while read ...
+    const pipeFromInterpreter = /\b(?:node|bash|sh|python[23]?|perl|ruby)\s+\S+\s*\|/i;
+    if (pipeFromInterpreter.test(fullCmd) && hasDestructive) {
+      await blockSelfProtection('SOLONGATE: Pipe from script to destructive command — blocked');
+    }
+
+    // 7-pre5. Script chaining: interpreter + destructive in same command chain
+    // Catches: node scan.mjs && rm -rf $(cat /tmp/targets.txt)
+    //          bash scan.sh; while read d < targets.txt; do rm -rf "$d"; done
+    const hasScriptExec = /\b(?:node|bash|sh|python[23]?|perl|ruby)\s+\S+\.\S+/i.test(fullCmd);
+    if (hasScriptExec && hasDestructive) {
+      await blockSelfProtection('SOLONGATE: Script execution + destructive command in chain — blocked');
+    }
+
     // 7a. Inline interpreter execution — TOTAL BLOCK (no content scan needed)
     // These can construct ANY string at runtime, bypassing all static analysis
     const blockedInterpreters = [
@@ -583,7 +610,8 @@ process.stdin.on('end', async () => {
 
     // 7b. Pipe-to-interpreter — TOTAL BLOCK
     // Any content piped to an interpreter can construct arbitrary commands at runtime
-    const pipeToInterpreter = /\|\s*(?:node|bash|sh|python[23]?|perl|ruby|php)\b/i;
+    // Also catches: | xargs node, | xargs bash, etc.
+    const pipeToInterpreter = /\|\s*(?:xargs\s+)?(?:node|bash|sh|python[23]?|perl|ruby|php)\b/i;
     if (pipeToInterpreter.test(fullCmd)) {
       await blockSelfProtection('SOLONGATE: Pipe to interpreter blocked — runtime bypass risk');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "MCP security proxy — protect any MCP server with customizable policies, path/command constraints, rate limiting, and audit logging. Zero code changes required.",
   "type": "module",
   "bin": {