mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-09 13:21:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix(security): block shell-collapse rm -rf / spellings at the hardline floor

Browse source 
rm -rf //, /., /./, /.. and //* all resolve to / in the shell but slipped
past the root-filesystem hardline pattern, whose target group only matched
the literal / and /* tokens. They fell to the softer DANGEROUS_PATTERNS
'delete in root path' rule, which --yolo / approvals.mode=off / cron
approve-mode are designed to bypass — leaving the one unconditional floor
open to a full root wipe under yolo.

Broaden the root token from '/|/\\*|/ \\*' to '/[/.]*\\**' inside
_hardline_rm_path so any root-anchored path whose components collapse back
to / (repeated slashes plus ./.. segments) with an optional trailing glob
is caught. A trailing real segment (/tmp, /home, /.ssh) still fails to
match and stays with the softer rules.

Co-authored-by: kernel-t1 <214165399+kernel-t1@users.noreply.github.com>
This commit is contained in:
teknium1 2026-07-01 02:29:09 -07:00 • committed by Teknium
parent d15a288812
commit 51feecc2b1
2 changed files with 55 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
tools/approval.py
View file

@ -367,7 +367,18 @@ HARDLINE_PATTERNS = [
# `${HOME}` brace form and quoted paths (`rm -rf "/"`, `rm -rf "$HOME"`)
# are handled via _hardline_rm_path so the floor cannot be bypassed with
# the ordinary quoting/brace shell idioms.
(_RM_FLAG_PREFIX + _hardline_rm_path(r'/|/\*|/ \*'), "recursive delete of root filesystem"),
#
# The path token matches any root-anchored path whose components collapse
# back to "/" in the shell: a bare "/", repeated slashes ("//"), and
# "."/".." current/parent segments ("/.", "/./", "/..") all resolve to
# root, optionally followed by a trailing glob ("/*", "//*"). The earlier
# "/|/\*|/ \*" form only caught the literal "/" / "/*" spellings, so
# `rm -rf //`, `rm -rf /.`, `rm -rf /./`, `rm -rf /..` and `rm -rf //*`
# silently slipped the hardline floor and executed under --yolo /
# approvals.mode=off / cron approve-mode. A trailing real segment
# (e.g. "/tmp", "/home", "/.ssh") still fails to match here and stays
# with the softer DANGEROUS_PATTERNS / system-directory rules.
(_RM_FLAG_PREFIX + _hardline_rm_path(r'/[/.]*\**'), "recursive delete of root filesystem"),
(_RM_FLAG_PREFIX + _hardline_rm_path(_HARDLINE_SYSTEM_DIRS), "recursive delete of system directory"),
(_RM_FLAG_PREFIX + _hardline_rm_path(r'(?:~|\$\{?HOME\}?)(?:/?|/\*)?'), "recursive delete of home directory"),
# Filesystem format