microcodex/bash-safety.cpp at main · paoloanzn/microcodex · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
// SPDX-FileCopyrightText: 2026 Paolo Anzani
// SPDX-License-Identifier: Apache-2.0

#include "bash-safety.h"

#include <array>
#include <regex>

namespace {

    struct DeniedCommandPattern {
        std::regex pattern;
        std::string_view reason;
    };

    const std::array<DeniedCommandPattern, 5> deniedCommandPatterns{{
        {
            std::regex{
                R"((^|[[:space:];|&()])([^[:space:];|&()]+/)?rm[[:space:]]+([^;|&\n]*[[:space:]])?(--force|-[[:alpha:]]*f[[:alpha:]]*)($|[[:space:];|&]))",
                std::regex::extended | std::regex::icase,
            },
            "forced file removal is blocked",
        },
        {
            std::regex{
                R"((^|[[:space:];|&()])git[[:space:]]+reset[[:space:]]+([^;|&\n]*[[:space:]])?--hard($|[[:space:];|&]))",
                std::regex::extended | std::regex::icase,
            },
            "git reset --hard is blocked",
        },
        {
            std::regex{
                R"((^|[[:space:];|&()])git[[:space:]]+clean[[:space:]]+([^;|&\n]*[[:space:]])?(-[[:alpha:]]*f[[:alpha:]]*|--force)($|[[:space:];|&]))",
                std::regex::extended | std::regex::icase,
            },
            "forced git clean is blocked",
        },
        {
            std::regex{
                R"((^|[[:space:];|&()])git[[:space:]]+checkout[[:space:]]+--($|[[:space:];|&]))",
                std::regex::extended | std::regex::icase,
            },
            "git checkout -- is blocked",
        },
        {
            std::regex{
                R"((^|[[:space:];|&()])(mkfs(\.[[:alnum:]_-]+)?|fdisk|parted|shutdown|reboot|halt|poweroff)($|[[:space:];|&]))",
                std::regex::extended | std::regex::icase,
            },
            "system or disk destructive command is blocked",
        },
    }};

} // namespace

namespace microcodex {

    std::optional<std::string_view> deniedBashCommandReason(const std::string_view command) {
        for (const DeniedCommandPattern &entry : deniedCommandPatterns) {
            if (std::regex_search(command.begin(), command.end(), entry.pattern)) {
                return entry.reason;
            }
        }
        return std::nullopt;
    }

} // namespace microcodex