(context: ValidationContext)
| 873 | } |
| 874 | |
| 875 | function validateRedirections(context: ValidationContext): PermissionResult { |
| 876 | const { fullyUnquotedContent } = context |
| 877 | |
| 878 | if (/</.test(fullyUnquotedContent)) { |
| 879 | logEvent('tengu_bash_security_check_triggered', { |
| 880 | checkId: BASH_SECURITY_CHECK_IDS.DANGEROUS_PATTERNS_INPUT_REDIRECTION, |
| 881 | subId: 1, |
| 882 | }) |
| 883 | return { |
| 884 | behavior: 'ask', |
| 885 | message: |
| 886 | 'Command contains input redirection (<) which could read sensitive files', |
| 887 | } |
| 888 | } |
| 889 | |
| 890 | if (/>/.test(fullyUnquotedContent)) { |
| 891 | logEvent('tengu_bash_security_check_triggered', { |
| 892 | checkId: BASH_SECURITY_CHECK_IDS.DANGEROUS_PATTERNS_OUTPUT_REDIRECTION, |
| 893 | subId: 1, |
| 894 | }) |
| 895 | return { |
| 896 | behavior: 'ask', |
| 897 | message: |
| 898 | 'Command contains output redirection (>) which could write to arbitrary files', |
| 899 | } |
| 900 | } |
| 901 | |
| 902 | return { behavior: 'passthrough', message: 'No redirections' } |
| 903 | } |
| 904 | |
| 905 | function validateNewlines(context: ValidationContext): PermissionResult { |
| 906 | // Use fullyUnquotedPreStrip (before stripSafeRedirections) to prevent bypasses |
nothing calls this directly
no test coverage detected