scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-08-28 05:25:00 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

guardrails: fix rm -rf path coverage and DELETE anchor (TriForge audit findings)

Browse source
This commit is contained in:
fwh888 2026-08-01 21:22:55 +08:00
parent 6038eecba8
commit 17f2046234
1 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
strix/agents/guardrails.py
View file

@ -11,19 +11,22 @@ STRIX_ALLOW_DESTRUCTIVE=1.
from __future__ import annotations from __future__ import annotations
import re import re
from typing import Optional
# SQL statements that are almost always destructive in a pentest context. # SQL statements that are almost always destructive in a pentest context.
_SQL_DESTRUCTIVE = re.compile( _SQL_DESTRUCTIVE = re.compile(
r"\b(DROP\s+(TABLE|DATABASE|SCHEMA|VIEW|INDEX|TRIGGER|FUNCTION|PROCEDURE)" r"\b(DROP\s+(TABLE|DATABASE|SCHEMA|VIEW|INDEX|TRIGGER|FUNCTION|PROCEDURE)"
r"|TRUNCATE\s+(TABLE\s+)?\w+" r"|TRUNCATE\s+(TABLE\s+)?\w+"
r"|DELETE\s+FROM\s+\w+\s*;?\s*$" r"|DELETE\s+FROM\s+\w+"
r"|ALTER\s+(TABLE|DATABASE|SCHEMA)\s+\w+\s+(DROP|DELETE|TRUNCATE))", r"|ALTER\s+(TABLE|DATABASE|SCHEMA)\s+\w+\s+(DROP|DELETE|TRUNCATE))",
re.IGNORECASE, re.IGNORECASE,
) )
# Shell patterns that are destructive regardless of arguments. # Shell patterns that are destructive regardless of arguments. The `rm -rf`
# branch matches any target (absolute path, home dir, `/*`, wildcard, …) —
# a recursive force delete is destructive no matter where it points.
_SHELL_DESTRUCTIVE = re.compile( _SHELL_DESTRUCTIVE = re.compile(
r"\brm\s+(-[a-z]*r[a-z]*f[a-z]*|-[a-z]*f[a-z]*r[a-z]*)\s+(/|/\*|~\s*/\*)" r"\brm\s+(-[a-z]*r[a-z]*f[a-z]*|-[a-z]*f[a-z]*r[a-z]*)\s+\S+"
r"|\bmkfs(\.\w+)?\b" r"|\bmkfs(\.\w+)?\b"
r"|\bdd\b[^|;]*\bof=/dev/" r"|\bdd\b[^|;]*\bof=/dev/"
r"|:\(\)\s*\{\s*:\|\:&\s*\}\s*;:" r"|:\(\)\s*\{\s*:\|\:&\s*\}\s*;:"
@ -33,7 +36,7 @@ _SHELL_DESTRUCTIVE = re.compile(
) )
def check_destructive(cmd: str) -> str | None: def check_destructive(cmd: str) -> Optional[str]:
"""Return a human-readable reason if *cmd* is destructive, else None. """Return a human-readable reason if *cmd* is destructive, else None.
The check is intentionally conservative: it only flags commands whose The check is intentionally conservative: it only flags commands whose
@ -46,5 +49,5 @@ def check_destructive(cmd: str) -> str | None:
if _SQL_DESTRUCTIVE.search(cmd): if _SQL_DESTRUCTIVE.search(cmd):
return "SQL statement may modify or destroy data (DROP/TRUNCATE/DELETE)" return "SQL statement may modify or destroy data (DROP/TRUNCATE/DELETE)"
if _SHELL_DESTRUCTIVE.search(cmd): if _SHELL_DESTRUCTIVE.search(cmd):
return "shell command may destroy data or affect the host (rm -rf /, mkfs, dd to /dev/, force push)" return "shell command may destroy data or affect the host (rm -rf, mkfs, dd to /dev/, force push)"
return None return None