Validate init.sh script execution - only allow ./init.sh. Returns: Tuple of (is_allowed, reason_if_blocked)
(command_string: str)
| 414 | |
| 415 | |
| 416 | def validate_init_script(command_string: str) -> tuple[bool, str]: |
| 417 | """ |
| 418 | Validate init.sh script execution - only allow ./init.sh. |
| 419 | |
| 420 | Returns: |
| 421 | Tuple of (is_allowed, reason_if_blocked) |
| 422 | """ |
| 423 | try: |
| 424 | tokens = shlex.split(command_string) |
| 425 | except ValueError: |
| 426 | return False, "Could not parse init script command" |
| 427 | |
| 428 | if not tokens: |
| 429 | return False, "Empty command" |
| 430 | |
| 431 | # The command should be exactly ./init.sh (possibly with arguments) |
| 432 | script = tokens[0] |
| 433 | |
| 434 | # Allow ./init.sh or paths ending in /init.sh |
| 435 | if script == "./init.sh" or script.endswith("/init.sh"): |
| 436 | return True, "" |
| 437 | |
| 438 | return False, f"Only ./init.sh is allowed, got: {script}" |
| 439 | |
| 440 | |
| 441 | def matches_pattern(command: str, pattern: str) -> bool: |
no outgoing calls