68 lines
1.9 KiB
JavaScript
68 lines
1.9 KiB
JavaScript
/**
|
|
* Shell exec-line / redirect policy helpers (env-driven denylists).
|
|
*/
|
|
|
|
/**
|
|
* Boot policy v4: comma list in `BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS`.
|
|
* @param {string} name
|
|
* @param {Record<string, string | undefined> | null | undefined} env
|
|
*/
|
|
export function isExecLineBuiltinDenied(name, env) {
|
|
const raw = env && env.BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS
|
|
if (raw == null || String(raw).trim() === '') return false
|
|
const set = new Set(
|
|
String(raw)
|
|
.split(',')
|
|
.map((s) => s.trim())
|
|
.filter(Boolean)
|
|
)
|
|
return set.has(name)
|
|
}
|
|
|
|
/**
|
|
* @param {string} key
|
|
* @param {Record<string, string | undefined> | null | undefined} env
|
|
*/
|
|
export function shellCsvSetFromEnv(key, env) {
|
|
const raw = env && env[key]
|
|
if (raw == null || String(raw).trim() === '') return new Set()
|
|
return new Set(
|
|
String(raw)
|
|
.split(',')
|
|
.map((s) => s.trim())
|
|
.filter(Boolean)
|
|
)
|
|
}
|
|
|
|
/**
|
|
* @param {string} name
|
|
* @param {Record<string, string | undefined> | null | undefined} env
|
|
*/
|
|
export function shellCommandDeniedByPolicy(name, env) {
|
|
const cmd = String(name || '').trim()
|
|
if (!cmd) return false
|
|
const deny = shellCsvSetFromEnv('BARE_OS_SHELL_DENY_COMMANDS', env)
|
|
if (deny.has(cmd)) return true
|
|
const allow = shellCsvSetFromEnv('BARE_OS_SHELL_ALLOW_COMMANDS', env)
|
|
if (allow.size > 0 && !allow.has(cmd)) return true
|
|
return false
|
|
}
|
|
|
|
/**
|
|
* @param {string} path
|
|
* @param {Record<string, string | undefined> | null | undefined} env
|
|
*/
|
|
export function shellUnsafeRedirectPath(path, env) {
|
|
const guardOn =
|
|
env &&
|
|
(env.BARE_OS_SHELL_REDIRECT_GUARD === '1' ||
|
|
env.BARE_OS_SHELL_REDIRECT_GUARD === 'true')
|
|
if (!guardOn) return false
|
|
const p = String(path || '').trim()
|
|
if (!p) return false
|
|
if (p.includes('/../') || p.startsWith('../') || p.endsWith('/..')) return true
|
|
if (p.startsWith('/proc/') || p.startsWith('/sys/') || p.startsWith('/dev/'))
|
|
return true
|
|
return false
|
|
}
|