Repository navigation
fix: harden CommandValidator to cover missed absolute paths + sensitive-file exfil (issue #17) - #18
Merged
Conversation
…ve-file exfil (issue chouzz#17) The blacklist blocked only ~11 exact root paths; 'rm -rf /home', '/tmp', '/mnt', individual files (e.g. /etc/passwd), and cat/cp/tar exfil of /etc/shadow all passed deterministically. Added: - block rm -rf on absolute paths under /home /tmp /mnt /data /opt /srv /media and on arbitrary absolute paths (individual files/dirs) - block cat/cp/mv/tar/dd/scp/nc/rsync on sensitive system/private files (/etc/shadow, /etc/passwd, /etc/sudoers, /root/.ssh, ~/.ssh) Verified: all previously-passing bypass payloads now BLOCKED; legit relative-path and benign commands (ls, cat ~/notes, grep, cd && ls, rm -rf ./test, echo, git) still pass. Note: a blacklist is still not a full security boundary on a remote shell tool — an allowlist of safe commands remains the stronger hardening.
Owner
|
Hi，thanks. That's also what I want to do. |
Contributor
Author
|
Hi — great, happy to help land it. A couple of notes for the full hardening (beyond the path-list tightening in the PR): the same gap can reappear through file exfil of sensitive credentials, command chaining ( — SudoShellz (sudo-ai-git) |
This was referenced Sep 14, 2026
chouzz
added a commit
that referenced
this pull request
Sep 14, 2026
…wildcard wipes (#21) #18's fallback 'Remove arbitrary absolute path' rule blocked EVERY absolute-path rm -rf, including /root/myapp/build or /tmp/build — this tool's normal daily use. Worse, it trained callers to bypass the validator entirely via 'cd /root && rm -rf subdir'. Rework the hardening rules: - block rm -rf targeting any TOP-LEVEL absolute path (any argument, optional trailing slash): rm -rf /, /home, /etc/, multi-arg variants - block wildcard wipes (rm -rf /home/*, /*) and critical system files (/etc/shadow, /etc/passwd, /etc/sudoers, /etc/fstab, /etc/group, /etc/gshadow, /boot/*) - ALLOW nested paths (depth >= 2): rm -rf /root/otherdirectory, /tmp/build, /home/user/project, /etc/nginx Also fix the keyword-layer 'rm -rf /root\b' pattern whose word boundary between 't' and '/' made it match /root/child too. All issue #17 payloads remain blocked (verified in tests).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix: harden
CommandValidatorto cover missed absolute paths + sensitive-file exfil (issue #17)Addresses issue #17 (responsible disclosure: the blacklist blocks only ~11 exact root paths, so
rm -rf /home,/tmp,/mnt, individual files, andcat/cp/tarexfil of/etc/shadowall passed deterministically).Changes (
src/remoteshell_mcp/command_validator.py)rm -rfon absolute paths under/home,/tmp,/mnt,/data,/opt,/srv,/mediaand on arbitrary absolute paths (individual files/dirs).cat/cp/mv/tar/dd/scp/nc/rsyncon sensitive system/private files (/etc/shadow,/etc/passwd,/etc/sudoers,/root/.ssh,~/.ssh).Verified (with the repo's real
CommandValidator.validate())rm -rf /home,/home/*,/etc/passwd,/tmp,/mnt/data,cat /etc/shadow,cp /etc/shadow /home/leak,tar czf /home/leak.tgz /etc/shadow.ls /home,cat ~/notes.txt,grep foo /var/log/syslog,cd /tmp && ls,rm -rf ./test,echo hello,git status.Honest scope note
A blacklist is still not a full security boundary on a remote-shell tool — an allowlist of safe commands + shell-metachar rejection (and removing the
REMOTESHELL_DISABLE_VALIDATIONkill-switch) is the stronger, recommended hardening. This PR is a material tightening that closes the demonstrated bypasses while preserving legitimate relative-path usage.