mirror of
https://github.com/Jeuners/ECC.git
synced 2026-09-09 15:02:30 +02:00
3cdc69a0ea
* fix(gateguard): check isDestructiveFindExec on each command segment
`isDestructiveBash` called `isDestructiveFindExec` only on the raw full
command string. When the raw string starts with a non-find command (e.g.
`echo x && find . -exec rm {} \;`), `isDestructiveFindExec` checks
tokens[0] and returns false — then the per-segment loop never calls it
again, letting the destructive `find -exec rm` segment through silently.
Fix: call `isDestructiveFindExec(segment)` inside the per-segment loop so
compound commands (`&&`, `;`, `|`) cannot be used to prepend a harmless
command and bypass the find-exec destructive check.
Adds three regression tests covering `&&`, `;`, and `|` bypass patterns.
* fix(gateguard): use raw body segments for isDestructiveFindExec to close quoted-binary gap
The previous per-segment call passed quote-stripped output from
splitCommandSegments to isDestructiveFindExec, so a quoted exec binary
like find . -exec 'rm' {} \; would arrive as find . -exec {} \; and
the check would silently miss it.
Switch to splitting collectExecutableBodies output on [;|&]+ without
quote-stripping first, so the find-exec binary name is always intact
when isDestructiveFindExec inspects it. This also covers || and
background & separators that the original tests did not exercise.
Adds a regression test for the || OR-chain bypass pattern.
Addresses Greptile review comments on PR #2292.
---------
Co-authored-by: kapilvus <kapilvus@gmail.com>
|
||
|---|---|---|
| .. | ||
| auto-tmux-dev.test.js | ||
| bash-hook-dispatcher.test.js | ||
| block-no-verify.test.js | ||
| check-hook-enabled.test.js | ||
| config-protection.test.js | ||
| continuous-learning-observe-runner.test.js | ||
| cost-tracker.test.js | ||
| cursor-block-no-verify.test.js | ||
| design-quality-check.test.js | ||
| detect-project-worktree.test.js | ||
| doc-file-warning.test.js | ||
| ecc-context-monitor.test.js | ||
| ecc-metrics-bridge.test.js | ||
| ecc-statusline.test.js | ||
| evaluate-session.test.js | ||
| gateguard-fact-force.test.js | ||
| governance-capture.test.js | ||
| hook-flags.test.js | ||
| hooks.test.js | ||
| insaits-security-monitor.test.js | ||
| insaits-security-wrapper.test.js | ||
| mcp-health-check.test.js | ||
| observe-entrypoint-allowlist.test.js | ||
| observe-subdirectory-detection.test.js | ||
| observer-memory.test.js | ||
| plugin-hook-bootstrap.test.js | ||
| post-bash-hooks.test.js | ||
| pre-bash-commit-quality.test.js | ||
| pre-bash-dev-server-block.test.js | ||
| pre-bash-reminders.test.js | ||
| quality-gate.test.js | ||
| run-with-flags-truncation.test.js | ||
| session-activity-tracker.test.js | ||
| session-end.test.js | ||
| stop-format-typecheck.test.js | ||
| stop-hooks-stdout.test.js | ||
| suggest-compact.test.js | ||
| test_insaits_security_monitor.py | ||