Orginize

packages/bare-os-booter/lib/shell/shell-policy.js

@@ -0,0 +1,67 @@
+/**
+ * Shell exec-line / redirect policy helpers (env-driven denylists).
+ */
+
+/**
+ * Boot policy v4: comma list in `BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS`.
+ * @param {string} name
+ * @param {Record<string, string | undefined> | null | undefined} env
+ */
+export function isExecLineBuiltinDenied(name, env) {
+  const raw = env && env.BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS
+  if (raw == null || String(raw).trim() === '') return false
+  const set = new Set(
+    String(raw)
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean)
+  )
+  return set.has(name)
+}
+
+/**
+ * @param {string} key
+ * @param {Record<string, string | undefined> | null | undefined} env
+ */
+export function shellCsvSetFromEnv(key, env) {
+  const raw = env && env[key]
+  if (raw == null || String(raw).trim() === '') return new Set()
+  return new Set(
+    String(raw)
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean)
+  )
+}
+
+/**
+ * @param {string} name
+ * @param {Record<string, string | undefined> | null | undefined} env
+ */
+export function shellCommandDeniedByPolicy(name, env) {
+  const cmd = String(name || '').trim()
+  if (!cmd) return false
+  const deny = shellCsvSetFromEnv('BARE_OS_SHELL_DENY_COMMANDS', env)
+  if (deny.has(cmd)) return true
+  const allow = shellCsvSetFromEnv('BARE_OS_SHELL_ALLOW_COMMANDS', env)
+  if (allow.size > 0 && !allow.has(cmd)) return true
+  return false
+}
+
+/**
+ * @param {string} path
+ * @param {Record<string, string | undefined> | null | undefined} env
+ */
+export function shellUnsafeRedirectPath(path, env) {
+  const guardOn =
+    env &&
+    (env.BARE_OS_SHELL_REDIRECT_GUARD === '1' ||
+      env.BARE_OS_SHELL_REDIRECT_GUARD === 'true')
+  if (!guardOn) return false
+  const p = String(path || '').trim()
+  if (!p) return false
+  if (p.includes('/../') || p.startsWith('../') || p.endsWith('/..')) return true
+  if (p.startsWith('/proc/') || p.startsWith('/sys/') || p.startsWith('/dev/'))
+    return true
+  return false
+}