ros/autocoder
1
0
Fork 0
mirror of https://github.com/leonvanzyl/autocoder.git synced 2026-03-17 10:53:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: prevent bare wildcard '*' from matching all commands

Browse Source 
Add validation to reject bare wildcards for security:
- matches_pattern(): return False if pattern == '*'
- validate_project_command(): reject name == '*' with clear error
- Added 4 new tests for bare wildcard rejection

This prevents a config with  from matching every command,
which would be a major security risk.

Tests: 140 unit tests passing (added 4 bare wildcard tests)
This commit is contained in:
Marian Paul
2026-01-22 12:40:31 +01:00
parent a9a0fcd865
commit d1dac1383d
2 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
test_security.py
View File

@@ -178,6 +178,11 @@ def test_pattern_matching():
("swift", "swift*", True, "swift matches swift*"),
("npm", "swift*", False, "npm doesn't match swift*"),
# Bare wildcard (security: should NOT match anything)
("npm", "*", False, "bare wildcard doesn't match npm"),
("sudo", "*", False, "bare wildcard doesn't match sudo"),
("anything", "*", False, "bare wildcard doesn't match anything"),
# Local script paths
("build.sh", "./scripts/build.sh", True, "script name matches path"),
("./scripts/build.sh", "./scripts/build.sh", True, "exact script path"),
@@ -293,6 +298,9 @@ def test_command_validation():
({"name": ""}, False, "empty name"),
({"name": 123}, False, "non-string name"),
# Security: Bare wildcard not allowed
({"name": "*"}, False, "bare wildcard rejected"),
# Blocklisted commands
({"name": "sudo"}, False, "blocklisted sudo"),
({"name": "shutdown"}, False, "blocklisted shutdown"),