scriptoriumadmin/Roo-Code
1
0
Fork 0
mirror of https://github.com/RooVetGit/Roo-Code.git synced 2026-09-08 22:21:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

More restrictions

Browse source
This commit is contained in:
John Richmond 2025-09-29 15:51:02 -07:00
parent 63b171b1a2
commit 3d737c66c5
2 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
webview-ui/src/utils/__tests__/command-validation.spec.ts
View file

@ -319,6 +319,11 @@ ls -la || echo "Failed"`
// Glob qualifiers with complex commands
expect(containsDangerousSubstitution("ls *(e:open -a Calculator:)")).toBe(true)
expect(containsDangerousSubstitution("rm *(e:sudo apt install malware:)")).toBe(true)
// Plus-shorthand qualifier that executes a command
expect(containsDangerousSubstitution("ls *(+whoami)")).toBe(true)
expect(containsDangerousSubstitution("ls *(.+{'whoami'})")).toBe(true)
expect(containsDangerousSubstitution('ls *(+"whoami")')).toBe(true)
})
it('detects bash $"..." string interpolation with command substitution', () => {
@ -1045,6 +1050,8 @@ describe("Unified Command Decision Functions", () => {
const globExploit = "ls *(e:whoami:)"
// Even though 'ls' might be allowed, the dangerous pattern prevents auto-approval
expect(getCommandDecision(globExploit, ["ls", "echo"], [])).toBe("ask_user")
// Plus-shorthand form should also prevent auto-approval
expect(getCommandDecision("ls *(+whoami)", ["ls", "echo"], [])).toBe("ask_user")
// Zsh extended glob with qualifier list and brace-arg form
expect(getCommandDecision("ls *(.e{'whoami'})", ["ls", "echo"], [])).toBe("ask_user")

7
webview-ui/src/utils/command-validation.ts
View file

@ -115,6 +115,12 @@ export function containsDangerousSubstitution(source: string): boolean {
// Any appearance of an "e" qualifier with an argument inside a glob qualifier list is dangerous.
const zshGlobQualifier = /\([^)]*e\s*(?::[^:]*:|\{[^}]*\}|'[^']*'|"[^"]*")[^)]*\)/.test(source)
// Check for zsh glob qualifier shorthand that executes code using +command during glob expansion
// Examples: *(+whoami), *(.+{'whoami'}), *(+"whoami")
// Treat + followed by a non-digit token inside a qualifier list as executable (exclude numeric-only like (+1))
const zshGlobQualifierPlusShorthand =
/[?*@+!]\([^)]*\+\s*(?:\{[^}]*\}|'[^']*'|"[^"]*"|[a-zA-Z_][^)\s]*)[^)]*\)/.test(source)
// Check for $"..." string interpolation with command substitution
// $"..." is a bash feature for translated strings that allows command substitution inside
// e.g., echo $"test$(whoami)" or echo $"test`pwd`"
@ -128,6 +134,7 @@ export function containsDangerousSubstitution(source: string): boolean {
hereStringWithSubstitution ||
zshProcessSubstitution ||
zshGlobQualifier ||
zshGlobQualifierPlusShorthand ||
bashTranslatedStringWithSubstitution
)
}