Function validateCommandFlags

packages/components/nodes/tools/MCP/core.ts:317–407

(command: string, args: string[])

 * @param args The arguments to validate
 */
export const validateCommandFlags = (command: string, args: string[]): void => {
    // Define dangerous flags for each command that enable code execution
    const dangerousFlagsByCommand: Record<string, string[]> = {
        npx: [
            '-c', // Execute shell commands
            '--call', // Execute shell commands
            '--shell-auto-fallback', // Shell execution fallback
            '-y', // Auto-confirms installation prompts
            '--yes', // Auto-confirms installation prompts
            '--node-options' // Passes arbitrary Node flags to underlying process, bypassing node flag blocklist
        ],
        node: [
            '-e', // Execute JavaScript code
            '--eval', // Execute JavaScript code
            '-p', // Evaluate and print JavaScript code
            '--print', // Evaluate and print JavaScript code
            '--inspect', // Enable remote debugging (security risk)
            '--inspect-brk', // Enable remote debugging with breakpoint (security risk)
            '--experimental-policy', // Could load malicious policies
            '-r', // Short alias for --require
            '--require', // Preload a CommonJS module before script runs
            '--loader', // Custom ES module loader hook (code execution)
            '--experimental-loader', // Same as --loader, older Node alias
            '--import', // Preload ESM module before entry script (Node 18+)
            '--env-file' // Read env vars from a local file (Node 20+, local file access)
        ],
        python: [
            '-c', // Execute Python code
            '-m' // Run library modules (could run malicious modules)
        ],
        python3: [
            '-c', // Execute Python code
            '-m' // Run library modules (could run malicious modules)
        ],
        docker: [
            'run', // Run containers (too powerful)
            'build', // Pulls a container and executes the run instructions
            'exec', // Execute in containers
            'compose', // Subcommand that starts containers (same risk as run)
            '-v', // Mount host filesystems
            '--volume', // Mount host filesystems
            '--mount', // Alternative to -v/--volume for mounting host paths
            '--volumes-from', // Mount volumes from another container (filesystem access)
            '--privileged', // Privileged mode
            '--cap-add', // Add capabilities
            '--security-opt', // Modify security options
            '--device', // Add host device files to container (privilege escalation)
            '--entrypoint', // Override container entrypoint (arbitrary code execution)
            '--network', // Host network access (catches --network=host and --network host)
            '--pid', // Host PID namespace (catches --pid=host and --pid host)
            '--ipc', // Host IPC namespace (catches --ipc=host and --ipc host)
            '--env-file' // Read env vars from a local host file (local file access)
        ]
    }

    const dangerousFlags = dangerousFlagsByCommand[command] || []

    // Collect single-char dangerous flags (e.g. '-c' -> 'c') for combined flag detection