ssh-mcp 2.18.0 → 2.19.0

package/README.md

@@ -595,9 +595,19 @@ there. ``), so the caller can see which spelling of the same command still works
 
 A separate **forbidden** list is never allowed, whatever the role or approval
 policy: `rm -rf /`, `mkfs`, `dd of=/dev/`, `shutdown`, `curl|sh`, fork bombs,
-writes to `/etc/cron`, `/etc/systemd` or `authorized_keys`, `iptables -F`, and
-recursive `chmod 777 /` / `chown /`. Add your own patterns via the policy
-denylist; an invalid pattern fails at startup rather than degrading silently.
+writes naming `/etc/cron`, `/etc/systemd` or any user's `authorized_keys`,
+`iptables -F`, and recursive `chmod 777 /` / `chown /`. A write *names* one of
+those paths when it is the remote path of an upload tool, the target of a shell
+redirect, or a destination of `tee`, `cp`, `mv`, `install` or `dd of=` — in any
+spelling the path readings above resolve. The two `/etc` families match by
+prefix, so `/etc/crontab` is covered along with everything under `/etc/cron.d`,
+and a sibling that merely starts like the directory (say `/etc/cronography`) is
+refused too — the fail-closed direction. Writes spelled any other way (`sed -i`,
+`rsync`, cmd.exe's `copy`, `move` and `robocopy`, a program handed to an
+interpreter, a path the target computes) are not on this list; class and approval
+govern them, and the operator denylist can close them. Add your own patterns via
+the policy denylist; an invalid pattern fails at
+startup rather than degrading silently.
 
 ### Approval Modes
 
@@ -693,8 +703,10 @@ The request shape is modeled on the AuthZEN Access Evaluation contract:
 For the five SFTP tools, `resource` also carries three path keys: `remotePath`,
 the path as given; and `remotePathNormalized` and `remotePathWindows`, the same
 two readings the local denylist tests, so a rule can match a canonical spelling
-without parsing `command` or reimplementing either reading in Rego. Other tools
-omit all three, and so does an empty path. `remotePath` is **as given** —
+without parsing `command` or reimplementing either reading in Rego. The two
+upload tools add `remoteWrite: true`, the fact the local policy refuses the
+never-allowed write paths on — a rule can gate writes without parsing `command`
+either. Other tools omit all four, and so does an empty path. `remotePath` is **as given** —
 `/root//.ssh/x` arrives spelled that way, so a `startswith` rule on a directory
 misses it: match trailing segments, or match the normalized keys.
 `remotePathWindows` keeps the case it was given; `lower()` both sides in the

package/build/policy/classifier.js

@@ -1,5 +1,6 @@
 import { AWK_NAMES, readAwkInvocation } from './awk.js';
 import { matchesGrammar } from './reader-grammar.js';
+import { findNeverAllowedWriteTarget, neverAllowedWriteLabel } from './never-allowed-writes.js';
 /**
  * Anything through which the shell can start a second command.
  *
@@ -588,7 +589,10 @@ const READ_ONLY_SYNTHETIC = new Set(['sftp:list', 'sftp:download']);
 /**
  * Commands that are never allowed, whatever the role or approval policy.
  *
- * This is the policy engine's denylist — the single definition of it. The
+ * This is the policy engine's denylist — the regex half of it. The word-based
+ * rules live below in FORBIDDEN_RULES, and the write-path families in
+ * never-allowed-writes.ts, which both the rules and the engine's resource
+ * check read. The
  * engine used to keep a parallel copy as regex *strings*, which had already
  * drifted (it was missing the fork bomb and the recursive chown, and its `rm`
  * pattern was narrower). Anything here is also destructive for classification
@@ -634,9 +638,6 @@ const FORBIDDEN_PATTERNS = [
     // against the target host rather than against this server, which is not worth either
     // trade — but it is a hole, not a closed door.
     /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/,
-    />\s*\/etc\/cron/,
-    />\s*\/etc\/systemd/,
-    />\s*~\/.ssh\/authorized_keys/,
     /\biptables\s+-F\b/,
     /\bchmod\s+-R\s+777\s+\//,
 ];
@@ -1483,9 +1484,20 @@ function pipesDownloadIntoShell(command, dialect = 'posix') {
         return false;
     return heads.slice(firstDownload + 1).some((h) => h !== undefined && SHELLS.has(h));
 }
-/** `dd … of=/dev/sda` — writing an image straight onto a block device. */
+/**
+ * `dd … of=/dev/sda` — writing an image straight onto a block device.
+ *
+ * Head via `effectiveCommandIndex`, not `parseSegments`: the privilege-prefix-only
+ * machine missed a wrapped `env dd of=/dev/sda` (measured in review) while the
+ * never-allowed write scan next door caught `env cp` — two dd readers two rules
+ * apart must not answer through different head-extraction machines.
+ */
 function writesToDevice(command, dialect = 'posix') {
-    return parseSegments(command, dialect).some(({ head, args }) => head === 'dd' && args.some((a) => a.startsWith('of=/dev/')));
+    return tokenizeSegments(command, dialect).some((words) => {
+        const idx = effectiveCommandIndex(words);
+        return idx !== -1 && stripPath(words[idx]) === 'dd'
+            && words.slice(idx + 1).some((a) => a.startsWith('of=/dev/'));
+    });
 }
 /**
  * `chown -R … /` — a recursive chown whose target is the filesystem root.
@@ -1501,6 +1513,309 @@ function chownsRoot(command, dialect = 'posix') {
         return positional[positional.length - 1] === '/';
     });
 }
+/**
+ * One dequoted word starting at `start`, as the redirect-target reader needs it.
+ *
+ * Stops at whitespace, at a character that begins another shell construct (`; | & < >
+ * ( )`), or at the end. Quotes are dropped and a closing quote does not end the
+ * word — the shell concatenates what follows it, so `> "/etc/cron.d"/x`,
+ * `> ""~/x` and `> a"b"c` all read as one target (the review round measured the
+ * `break`-on-close reading as a bypass: `> ""~/.ssh/authorized_keys` fell through).
+ * The quote/escape state machine is the same one `tokenizeSegmentsDetailed` runs
+ * (both keyed on DOUBLE_QUOTE_ESCAPABLE); a dialect fix must land in both loops.
+ */
+function readDequotedWord(command, start, dialect) {
+    const n = command.length;
+    if (start >= n || /[\s;&|<>()]/.test(command[start]))
+        return '';
+    let word = '';
+    let quote = command[start] === '"' || command[start] === "'" ? command[start] : null;
+    let escaped = false;
+    for (let i = quote === null ? start : start + 1; i < n; i++) {
+        const ch = command[i];
+        if (escaped) {
+            word += ch;
+            escaped = false;
+            continue;
+        }
+        if (dialect === 'posix' && ch === '\\') {
+            if (quote === "'") {
+                word += ch;
+                continue;
+            }
+            if (quote === '"') {
+                const next = command[i + 1];
+                if (next === undefined || DOUBLE_QUOTE_ESCAPABLE.has(next)) {
+                    escaped = true;
+                    continue;
+                }
+                word += ch;
+                continue;
+            }
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote) {
+                quote = null;
+                continue;
+            }
+            word += ch;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (/[\s;&|<>()]/.test(ch))
+            break;
+        word += ch;
+    }
+    return word;
+}
+/**
+ * Every shell-redirect target in `command`, dequoted the way the shell will pass it.
+ *
+ * A redirect is an unquoted `>` — alone (`> f`), attached to the word it ends
+ * (`echo x>f`, which bash also reads as a redirect), doubled (`>>`), with an fd
+ * prefix (`2>`, `2>>`), with the both-streams spellings (`&>`, `&>>`, `>&`) or
+ * with the noclobber-override marker (`>|`). A `>` inside quotes is data
+ * (`echo "> f"` prints a string) and yields nothing, which is what separates this
+ * scan from the raw regexes it replaces: those fired on the quoted text too, so a
+ * commit message quoting a redirect was a refusal nobody could switch off
+ * (measured on main).
+ *
+ * The target is the next word after the operator, quoted or attached. An operator
+ * with nothing readable after it is a syntax error the remote shell would report,
+ * and yields nothing. `>(...)` process substitution yields nothing here too — its
+ * inner command is a carrier `nestedCommands` already reads.
+ */
+function redirectTargets(command, dialect) {
+    const targets = [];
+    const n = command.length;
+    let quote = null;
+    let escaped = false;
+    for (let i = 0; i < n; i++) {
+        const ch = command[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (dialect === 'posix' && ch === '\\' && quote !== "'") {
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (ch !== '>' && !(ch === '&' && command[i + 1] === '>'))
+            continue;
+        let j = ch === '&' ? i + 2 : i + 1;
+        if (command[j] === '>')
+            j++; // >>
+        if (command[j] === '&')
+            j++; // >& fd duplication
+        if (command[j] === '|')
+            j++; // >| noclobber override
+        while (j < n && /\s/.test(command[j]))
+            j++;
+        const word = readDequotedWord(command, j, dialect);
+        if (word !== '')
+            targets.push(word);
+        i = j - 1;
+    }
+    return targets;
+}
+/**
+ * xargs's own value-taking flags — one tool's option set, enumerable the way
+ * `PREFIX_VALUE_FLAGS` holds sudo's. `effectiveCommandIndex` steps a wrapper's
+ * flags with *sudo's* set, so `xargs -I {}` leaves `{}` looking like the command
+ * and the verb xargs really runs hides behind it (measured in review:
+ * `xargs -I {} cp {} /root/.ssh/authorized_keys` passed).
+ */
+const XARGS_VALUE_FLAGS = new Set(['-I', '-J', '-d', '-E', '-n', '-s', '-P', '-R', '-L', '-S']);
+/**
+ * The command index for a segment whose wrapper may be `xargs`, which the plain
+ * `effectiveCommandIndex` cannot step past. Same walk, one addition; runs
+ * alongside the plain index so nothing else changes.
+ */
+function indexPastXargsFlags(words) {
+    let i = 0;
+    while (i < words.length) {
+        const raw = words[i];
+        const word = stripPath(unquote(raw));
+        if (word === 'xargs') {
+            i++;
+            while (i < words.length && words[i].startsWith('-')) {
+                const consumesValue = XARGS_VALUE_FLAGS.has(words[i]);
+                i++;
+                if (consumesValue)
+                    i++;
+            }
+            continue;
+        }
+        if (PRIVILEGE_PREFIXES.has(word) || EXEC_WRAPPERS.has(word)) {
+            i++;
+            continue;
+        }
+        if (ASSIGNMENT.test(raw) || raw.startsWith('-') || BARE_NUMERIC.test(raw)) {
+            i++;
+            continue;
+        }
+        return i;
+    }
+    return -1;
+}
+/**
+ * The positional operands of the copy family, with every option spelling that
+ * carries a value stepped over.
+ *
+ * GNU getopt permutes options anywhere in the argv — `install k
+ * /root/.ssh/authorized_keys -m 600` is ordinary usage — so a value-taking flag
+ * trailing the destination must not have its value read as the last positional
+ * (measured in review: it displaced the destination and the write was missed).
+ * `-t`/`--target-directory` in all three spellings (`-t DIR`, `-tDIR`,
+ * `--target-directory=DIR`, `--target-directory DIR`) is stepped here too; the
+ * caller reads its value as the destination itself.
+ */
+function copyPositionals(args) {
+    const positional = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '-t' || arg === '--target-directory') {
+            i++;
+            continue;
+        }
+        if (/^-t.+/.test(arg) || /^--target-directory=/.test(arg))
+            continue;
+        // An attached short value (`-m600`) needs no line of its own: the generic
+        // `-` skip below already keeps it out of the positionals.
+        if (arg === '-m' || arg === '-o' || arg === '-g' || arg === '-S' || arg === '-Z') {
+            i++;
+            continue;
+        }
+        if (/^--(mode|owner|group|suffix|context|sparse)=/.test(arg))
+            continue;
+        if (arg === '--mode' || arg === '--owner' || arg === '--group' || arg === '--suffix'
+            || arg === '--context' || arg === '--sparse') {
+            i++;
+            continue;
+        }
+        if (arg.startsWith('-'))
+            continue;
+        positional.push(arg);
+    }
+    return positional;
+}
+/**
+ * The destination operands of the verbs whose argv names the file they write.
+ *
+ * A closed list, on purpose. `tee` writes every non-flag operand; `cp`, `mv` and
+ * `install` write their destination operand — the value of `-t`/
+ * `--target-directory` in any of its spellings when present, else the last
+ * positional — and, because that operand may name a directory the sources are
+ * copied *into*, the same joined with each source's basename, so `cp
+ * authorized_keys ~/.ssh/` is caught rather than only `cp k
+ * ~/.ssh/authorized_keys`. `install -d` creates every operand. `dd of=` writes
+ * the value. Every other verb is a documented residual: a guess about an
+ * unrecognised binary's operands must not reach this list (the
+ * `speculativeOperands: false` ruling), and #230's decision 1 already ruled that
+ * extracting paths from shell text can never be complete — so the README lists
+ * these forms and names the rest as governed by class and approval instead.
+ *
+ * `env cp …`, `sudo cp …`, `timeout 5 cp …` and `xargs -I {} cp …` reach the
+ * verb through `effectiveCommandIndex` and its xargs-stepping sibling.
+ */
+function writeVerbTargets(command, dialect) {
+    const targets = [];
+    for (const words of tokenizeSegments(command, dialect)) {
+        const heads = [effectiveCommandIndex(words), indexPastXargsFlags(words)]
+            .filter((i, idx, all) => i !== -1 && all.indexOf(i) === idx);
+        for (const idx of heads) {
+            const head = stripPath(words[idx]);
+            const args = words.slice(idx + 1);
+            if (head === 'tee') {
+                targets.push(...args.filter((a) => !a.startsWith('-')));
+                continue;
+            }
+            if (head === 'dd') {
+                for (const arg of args) {
+                    if (arg.startsWith('of='))
+                        targets.push(arg.slice(3));
+                }
+                continue;
+            }
+            if (head === 'cp' || head === 'mv' || head === 'install') {
+                const positional = copyPositionals(args);
+                if (head === 'install' && args.some((a) => a === '-d' || a === '--directory')) {
+                    targets.push(...positional);
+                    continue;
+                }
+                const tIndex = args.findIndex((a) => a === '-t' || a === '--target-directory'
+                    || /^-t.+/.test(a) || a.startsWith('--target-directory='));
+                let dest = null;
+                let sources = positional;
+                if (tIndex !== -1) {
+                    const flag = args[tIndex];
+                    if (flag === '-t' || flag === '--target-directory') {
+                        dest = args[tIndex + 1] || null;
+                    }
+                    else {
+                        const eq = flag.indexOf('=');
+                        dest = eq === -1 ? flag.slice(2) : flag.slice(eq + 1);
+                    }
+                }
+                else if (positional.length >= 2) {
+                    dest = positional[positional.length - 1];
+                    sources = positional.slice(0, -1);
+                }
+                if (dest === null || dest === '')
+                    continue;
+                targets.push(dest);
+                for (const src of sources) {
+                    const base = stripPath(src);
+                    if (base !== '')
+                        targets.push(`${dest}/${base}`);
+                }
+            }
+        }
+    }
+    return targets;
+}
+/**
+ * The never-allowed family cache — same shape and reason as `normalizedCache`:
+ * three ForbiddenRule entries ask the same (command, dialect) question in a row,
+ * and each ask re-ran both scans over the whole command. Keyed with the dialect
+ * because both readings of one command are asked in the same row.
+ */
+const neverAllowedWriteCache = new Map();
+/**
+ * Which never-allowed family this command's certain write forms name, or null.
+ * Both dialects are tried by the caller (findForbiddenMatchInDialect), and nested
+ * commands reach this through the same recursion every other rule uses.
+ */
+function findNeverAllowedWriteFamily(command, dialect) {
+    const key = `${dialect}\u0000${command}`;
+    if (neverAllowedWriteCache.has(key))
+        return neverAllowedWriteCache.get(key);
+    let family = null;
+    for (const candidate of [...redirectTargets(command, dialect), ...writeVerbTargets(command, dialect)]) {
+        family = findNeverAllowedWriteTarget(candidate);
+        if (family !== null)
+            break;
+    }
+    neverAllowedWriteCache.set(key, family);
+    if (neverAllowedWriteCache.size > 8) {
+        neverAllowedWriteCache.delete(neverAllowedWriteCache.keys().next().value);
+    }
+    return family;
+}
 const FORBIDDEN_RULES = [
     ...FORBIDDEN_PATTERNS.map((re) => ({
         label: String(re),
@@ -1516,6 +1831,10 @@ const FORBIDDEN_RULES = [
     },
     { label: 'dd writing to a block device (of=/dev/…)', test: (c, dialect) => writesToDevice(c, dialect) },
     { label: 'a recursive chown of the filesystem root', test: (c, dialect) => chownsRoot(c, dialect) },
+    ...['/etc/cron', '/etc/systemd', 'authorized_keys'].map((family) => ({
+        label: neverAllowedWriteLabel(family),
+        test: (command, dialect) => findNeverAllowedWriteFamily(command, dialect) === family,
+    })),
 ];
 /**
  * Which never-allowed rule this command trips, or null. The single entry point:

package/build/policy/engine.js

@@ -1,6 +1,9 @@
 import { classifyCommand, findForbiddenMatch, formatReadOnlyRejection } from './classifier.js';
 import { normalizeRemotePath, normalizeRemotePathForWindows } from './remote-path.js';
+import { findNeverAllowedWriteTarget, neverAllowedWriteLabel } from './never-allowed-writes.js';
 import { OperatorError } from '../errors.js';
+/** The operator-facing promise every built-in never-allowed refusal ends with. */
+const NEVER_ALLOWED_TRAILER = 'This list cannot be switched off — the [policy].denylist key adds patterns, it does not remove these.';
 /**
  * How long to wait for the OPA sidecar before treating it as unavailable.
  *
@@ -316,6 +319,7 @@ export class PolicyEngine {
                     binary: parsed.binary,
                     host: profile.host,
                     remotePath,
+                    remoteWrite: resource.remoteWrite || undefined,
                     remotePathNormalized: remotePath === undefined ? undefined : normalizeRemotePath(remotePath),
                     remotePathWindows: remotePath === undefined ? undefined : normalizeRemotePathForWindows(remotePath),
                 },
@@ -505,8 +509,17 @@ export class PolicyEngine {
     findDenyMatch(command, resource) {
         const builtIn = findForbiddenMatch(command);
         if (builtIn) {
-            return `Command matches a built-in never-allowed rule: ${builtIn}. ` +
-                `This list cannot be switched off — the [policy].denylist key adds patterns, it does not remove these.`;
+            return `Command matches a built-in never-allowed rule: ${builtIn}. ${NEVER_ALLOWED_TRAILER}`;
+        }
+        // The built-in never-allowed write paths, tested against a remote path the tool
+        // declared it writes. Runs before the early return below because the defaults
+        // carry no operator denylist — this check is not the operator's to switch on.
+        if (resource.remoteWrite && resource.remotePath) {
+            const target = findNeverAllowedWriteTarget(resource.remotePath);
+            if (target !== null) {
+                return `Remote path ${quotePath(resource.remotePath)} matches a built-in never-allowed rule: ` +
+                    `${neverAllowedWriteLabel(target)}. ${NEVER_ALLOWED_TRAILER}`;
+            }
         }
         // Nothing below can match: skip reading the path at all, which is the commonest
         // config — the defaults carry no denylist.

package/build/policy/never-allowed-writes.js

@@ -0,0 +1,51 @@
+import { normalizeRemotePath, normalizeRemotePathForWindows } from './remote-path.js';
+/**
+ * The `/etc` families are prefix matches with no boundary: `/etc/crontab` sits under
+ * `/etc/cron` the same way `/etc/cron.d/x` does, which is how the redirect regex this
+ * module replaces always read it. A sibling that merely starts like the directory
+ * (`/etc/cronography`) fires too — over-refusal in the fail-closed direction this
+ * engine takes everywhere else.
+ */
+const NEVER_DIRS = ['/etc/cron', '/etc/systemd'];
+/** The keys family: any path whose last two segments are `.ssh/authorized_keys`. */
+const KEYS_TAIL = '/.ssh/authorized_keys';
+/**
+ * The refusal wording for a family, defined once because two check sites quote it:
+ * the classifier's ForbiddenRule label and the engine's built-in deny reason.
+ */
+export function neverAllowedWriteLabel(target) {
+    switch (target) {
+        case '/etc/cron': return 'writing to /etc/cron';
+        case '/etc/systemd': return 'writing to /etc/systemd';
+        case 'authorized_keys': return "writing to any user's authorized_keys";
+    }
+}
+function familyOf(path) {
+    for (const dir of NEVER_DIRS) {
+        if (path.startsWith(dir))
+            return dir;
+    }
+    if (path.endsWith(KEYS_TAIL) || path === KEYS_TAIL.slice(1))
+        return 'authorized_keys';
+    return null;
+}
+/**
+ * Whether `path` names one of the never-allowed write targets, in any spelling the
+ * path readings resolve.
+ *
+ * The same three readings `[policy].denylist` sees (#230): the path as given; a
+ * lexically normalized reading (`//`, `/./`, `..`, trailing separators, `\` as a
+ * separator); and the Windows reading of it, case-insensitively — so `Authorized_Keys.`,
+ * `authorized_keys::$DATA` and backslash spellings reach the same refusal. On a POSIX
+ * target some of those are different files; refusing them is the safe direction, the
+ * same trade the operator denylist already makes.
+ *
+ * What this does not do is resolve anything on the target: a relative path stays
+ * relative, symlinks are not followed, and an 8.3 short name is not expanded (#230's
+ * documented residuals, inherited here).
+ */
+export function findNeverAllowedWriteTarget(path) {
+    return familyOf(path)
+        ?? familyOf(normalizeRemotePath(path))
+        ?? familyOf(normalizeRemotePathForWindows(path).toLowerCase());
+}

package/build/tools/file-tools.js

@@ -53,7 +53,7 @@ export function registerFileTools({ server }, pipeline) {
             profile,
             extra,
             synthetic: true,
-            resource: { remotePath },
+            resource: { remotePath, remoteWrite: true },
             preCheck: () => { sanitizeRemotePath(remotePath); },
         }, async (rt) => {
             await new SftpClient(rt.conn).upload({ remotePath, content });

package/build/tools/transfer-tools.js

@@ -256,7 +256,7 @@ export function registerTransferTools({ server, localPath }, pipeline) {
             profile,
             extra,
             synthetic: true,
-            resource: { remotePath },
+            resource: { remotePath, remoteWrite: true },
             preCheck: () => { sanitizeRemotePath(remotePath); checkMode(mode); },
         }, async (rt) => {
             const maxBytes = rt.conn.profile.transferMaxBytes;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.18.0",
+  "version": "2.19.0",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "mcpName": "io.github.tufantunc/ssh-mcp",
   "type": "module",