seb/hermes-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(approval): gate in-place edits to sensitive user files

Browse Source 
Cover sed, perl, and ruby in-place mutations against shell rc, SSH, and credential files so terminal approvals pair the redirection and copy guards.
This commit is contained in:
Teknium
2026-06-13 14:35:27 -07:00
parent abd69b8117
commit 2b67e96aec
2 changed files with 48 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/approval.py
+12
View File
@@ -208,6 +208,11 @@ _SENSITIVE_WRITE_TARGET = (
rf'{_SHELL_RC_FILES}|'
rf'{_CREDENTIAL_FILES})'
)
_USER_SENSITIVE_WRITE_TARGET = (
rf'(?:{_SSH_SENSITIVE_PATH}|'
rf'{_SHELL_RC_FILES}|'
rf'{_CREDENTIAL_FILES})'
)
_PROJECT_SENSITIVE_WRITE_TARGET = rf'(?:{_PROJECT_ENV_PATH}|{_PROJECT_CONFIG_PATH})'
_COMMAND_TAIL = r'(?:\s*(?:&&|\|\||;).*)?$'
@@ -455,6 +460,13 @@ DANGEROUS_PATTERNS = [
# The trailing `[^\s"\']*` consumes the rest of the destination filename
# (e.g. `authorized_keys` after the `~/.ssh/` fragment).
(rf'\b(cp|mv|install)\b.*\s["\']?{_SENSITIVE_WRITE_TARGET}[^\s"\']*["\']?{_COMMAND_TAIL}', "copy/move file into sensitive credential/SSH/shell-rc path"),
# In-place edits mutate the target file directly, bypassing redirection,
# tee, and copy/move/install coverage. Gate the same user-controlled
# startup/credential files so `sed -i ... ~/.bashrc` and `perl -i ...
# ~/.ssh/authorized_keys` cannot silently plant login commands or keys.
(rf'\bsed\s+-[^\s]*i.*(?:{_USER_SENSITIVE_WRITE_TARGET})[^\s"\']*', "in-place edit of sensitive credential/SSH/shell-rc path"),
(rf'\bsed\s+--in-place\b.*(?:{_USER_SENSITIVE_WRITE_TARGET})[^\s"\']*', "in-place edit of sensitive credential/SSH/shell-rc path (long flag)"),
(rf'\b(?:perl|ruby)\b.*(?:^|\s)-[^\s]*i\b.*(?:{_USER_SENSITIVE_WRITE_TARGET})[^\s"\']*', "in-place edit of sensitive credential/SSH/shell-rc path (perl/ruby)"),
(rf'\bsed\s+-[^\s]*i.*\s{_SYSTEM_CONFIG_PATH}', "in-place edit of system config"),
(rf'\bsed\s+--in-place\b.*\s{_SYSTEM_CONFIG_PATH}', "in-place edit of system config (long flag)"),
# In-place edit of a Hermes-managed security file (~/.hermes/config.yaml or