scriptoriumadmin/Roo-Code
1
0
Fork 0
mirror of https://github.com/RooVetGit/Roo-Code.git synced 2026-09-07 08:26:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

More patterns

Browse source
This commit is contained in:
John Richmond 2025-09-29 15:43:28 -07:00
parent 952d8af3e8
commit 63b171b1a2
2 changed files with 11 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
webview-ui/src/utils/__tests__/command-validation.spec.ts
View file

@ -301,6 +301,8 @@ ls -la || echo "Failed"`
it("detects zsh glob qualifiers with code execution (e:...:)", () => {
// Basic glob qualifier with command execution
expect(containsDangerousSubstitution("ls *(e:whoami:)")).toBe(true)
// Zsh extended glob with qualifier list and brace-arg: e{'whoami'} as reported
expect(containsDangerousSubstitution("ls *(.e{'whoami'})")).toBe(true)
// Various glob patterns with code execution
expect(containsDangerousSubstitution("cat ?(e:rm -rf /:)")).toBe(true)
@ -1043,6 +1045,8 @@ describe("Unified Command Decision Functions", () => {
const globExploit = "ls *(e:whoami:)"
// Even though 'ls' might be allowed, the dangerous pattern prevents auto-approval
expect(getCommandDecision(globExploit, ["ls", "echo"], [])).toBe("ask_user")
// Zsh extended glob with qualifier list and brace-arg form
expect(getCommandDecision("ls *(.e{'whoami'})", ["ls", "echo"], [])).toBe("ask_user")
// Various forms should all be blocked
expect(getCommandDecision("cat ?(e:rm -rf /:)", ["cat"], [])).toBe("ask_user")

11
webview-ui/src/utils/command-validation.ts
View file

@ -107,10 +107,13 @@ export function containsDangerousSubstitution(source: string): boolean {
// =(...) creates a temporary file containing the output of the command, but executes it
const zshProcessSubstitution = /=\([^)]+\)/.test(source)
// Check for zsh glob qualifiers with code execution (e:...:)
// Patterns like *(e:whoami:) or ?(e:rm -rf /:) execute commands during glob expansion
// This regex matches patterns like *(e:...:), ?(e:...:), +(e:...:), @(e:...:), !(e:...:)
const zshGlobQualifier = /[*?+@!]\(e:[^:]+:\)/.test(source)
// Check for zsh glob qualifiers with code execution via the "e" qualifier
// This must detect multiple zsh forms that execute code during glob expansion:
// - Classic: *(e:whoami:) or ?(e:rm -rf /:) etc.
// - With other qualifiers: *(.e:whoami:) (dot means "plain files" plus e:...)
// - Brace/quoted argument forms: *(e{'whoami'}), *(.e{'whoami'}), *(e{"whoami"}), *(.e{"whoami"})
// Any appearance of an "e" qualifier with an argument inside a glob qualifier list is dangerous.
const zshGlobQualifier = /\([^)]*e\s*(?::[^:]*:|\{[^}]*\}|'[^']*'|"[^"]*")[^)]*\)/.test(source)
// Check for $"..." string interpolation with command substitution
// $"..." is a bash feature for translated strings that allows command substitution inside