ssh-mcp 2.2.4 → 2.2.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/policy/classifier.js +21 -1
- package/package.json +1 -1
|
@@ -107,7 +107,27 @@ const FORBIDDEN_PATTERNS = [
|
|
|
107
107
|
const FORBIDDEN_INVOCATIONS = new Set(['shutdown', 'reboot', 'halt', 'poweroff', 'eval']);
|
|
108
108
|
/** Binaries that take the dangerous action as an argument: `systemctl reboot`. */
|
|
109
109
|
const ACTION_MULTIPLEXERS = new Set(['systemctl', 'init', 'telinit']);
|
|
110
|
-
|
|
110
|
+
/**
|
|
111
|
+
* Binaries that run the rest of the command as another user.
|
|
112
|
+
*
|
|
113
|
+
* The list is explicit rather than a pattern, because a pattern cannot tell
|
|
114
|
+
* `sudoedit` — which edits a file and is not elevation — from `sudo-rs`, which
|
|
115
|
+
* is sudo. It has to be maintained by hand as new implementations appear; the
|
|
116
|
+
* cost of missing one is that its commands classify `safe`.
|
|
117
|
+
*
|
|
118
|
+
* The last five were added in 2.2.5 (#132). Until 2.2.4 the check was
|
|
119
|
+
* `/^\s*su\b/` and friends, and `\b` matched between `su` and the hyphen, so
|
|
120
|
+
* `su-exec` and `sudo-rs` were caught — by accident of the regex, not by
|
|
121
|
+
* intent. Moving to exact membership dropped them, which narrowed a security
|
|
122
|
+
* control inside a security release. `gosu` and `run0` were never caught by
|
|
123
|
+
* either form.
|
|
124
|
+
*/
|
|
125
|
+
const PRIVILEGE_PREFIXES = new Set([
|
|
126
|
+
'sudo', 'su', 'doas', 'pkexec',
|
|
127
|
+
// BusyBox/Alpine, Docker entrypoints, the Rust sudo now default on some
|
|
128
|
+
// distributions, systemd's replacement, and the Solaris/illumos spelling.
|
|
129
|
+
'su-exec', 'gosu', 'sudo-rs', 'run0', 'pfexec',
|
|
130
|
+
]);
|
|
111
131
|
/**
|
|
112
132
|
* Binaries whose job is to run another command.
|
|
113
133
|
*
|
package/package.json
CHANGED