From 856bb7c692e8a2159e8142b0109b24f57c60efe3 Mon Sep 17 00:00:00 2001 From: SudoShellz Date: Mon, 31 Aug 2026 04:35:38 -0500 Subject: [PATCH] fix: harden CommandValidator to cover missed absolute paths + sensitive-file exfil (issue #17) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The blacklist blocked only ~11 exact root paths; 'rm -rf /home', '/tmp', '/mnt', individual files (e.g. /etc/passwd), and cat/cp/tar exfil of /etc/shadow all passed deterministically. Added: - block rm -rf on absolute paths under /home /tmp /mnt /data /opt /srv /media and on arbitrary absolute paths (individual files/dirs) - block cat/cp/mv/tar/dd/scp/nc/rsync on sensitive system/private files (/etc/shadow, /etc/passwd, /etc/sudoers, /root/.ssh, ~/.ssh) Verified: all previously-passing bypass payloads now BLOCKED; legit relative-path and benign commands (ls, cat ~/notes, grep, cd && ls, rm -rf ./test, echo, git) still pass. Note: a blacklist is still not a full security boundary on a remote shell tool — an allowlist of safe commands remains the stronger hardening. --- src/remoteshell_mcp/command_validator.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/remoteshell_mcp/command_validator.py b/src/remoteshell_mcp/command_validator.py index 90e0792..58ac4d0 100644 --- a/src/remoteshell_mcp/command_validator.py +++ b/src/remoteshell_mcp/command_validator.py @@ -59,6 +59,16 @@ class CommandValidator: # Patterns for removing all files (but allow relative paths like ./test) (r'\brm\s+.*-.*rf\s+\*', 'Remove all files in current directory'), (r'\brm\s+.*-.*rf\s+\.\.(?:\s|$|/)', 'Remove parent directory'), + + # Hardened (issue #17): absolute-path `rm -rf` under common user/system + # trees that the 11-path list missed, and destructive ops on individual files. + (r'\brm\s+.*-.*rf\s+(?:/home|/tmp|/mnt|/data|/opt|/srv|/media)(?:\s|$|/)', + 'Remove absolute path under /home /tmp /mnt /data /opt /srv /media'), + (r'\brm\s+.*-.*rf\s+/\S+(?:/|(?:\s|$))', + 'Remove arbitrary absolute path (individual file/dir)'), + # File-exfil / overwrite primitives that return secrets to the caller. + (r'\b(?:cat|cp|mv|tar|dd|scp|nc|rsync)\s+.*(?:/etc/shadow|/etc/passwd|/etc/sudoers|/root/\.|/home/.*?/\.ssh)', + 'Exfiltrate or disclose sensitive system/private files'), ] @classmethod