fix(permission): 支持跨平台删除指令与命令边界识别,避免参数误拦截 - #550
Closed
yee211 wants to merge 1 commit into
Closed
Conversation
…dary-aware regex - Update permission rules across s03-s14 and s17 with boundary-aware regex - Support Windows deletion commands (del, rmdir, erase) and flag formats - Prevent false positives on non-destructive commands like 'echo del test.txt' or 'git commit -m del' - Add parameterized regression test suite tests/test_permission_destructive_boundaries.py - Re-generate web versions.json via extract-content script
Collaborator
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
动机与背景 (Motivation)
del、rmdir、erase),原安全规则仅匹配了 Linux 的rm,导致在 Windows 上删除文件时绕过了安全闸门。in command)的匹配方式,会导致作为参数出现的词(如echo del test.txt、git commit -m "del test"、grep rm file.py)被错误拦截。主要修改 (Changes)
统一引入命令边界正则:
DESTRUCTIVE_PATTERN = r"(?:^|[;&|\n]|&&|\|\|)\s*(?:rm|del|rmdir|erase)(?:[\s/]|$)|> /etc/|chmod 777"&&、||、;、&、|、\n)后的删除指令才会被识别;del/f、rmdir/s/q);echo/git/grep等命令中携带关键字时的误拦截。s03~s14及s17相关的 13 个章节代码。tests/test_permission_destructive_boundaries.py,包含 69 个参数化测试用例,覆盖独立命令、链式连接符、大小写及参数防误报场景。extract-content重新生成了versions.json和docs.json。测试验证 (Testing)
pytest tests/test_permission_destructive_boundaries.py,69 个测试用例全部通过(100% Passed)。python s03_permission/code.py,成功精准拦截del test.txt且正常放行echo del test.txt。