| 9 | ) |
| 10 | |
| 11 | func RunShellSafetyChecks(command, cwd string) error { |
| 12 | securityResult := bashpkg.RunAllSecurityChecks(command) |
| 13 | if bashpkg.IsBlocking(securityResult) { |
| 14 | descriptions := make([]string, 0, len(securityResult.Findings)) |
| 15 | for i, finding := range securityResult.Findings { |
| 16 | if i >= 3 { |
| 17 | break |
| 18 | } |
| 19 | descriptions = append(descriptions, finding.Description) |
| 20 | } |
| 21 | return fmt.Errorf("Inline shell blocked by security checks: %s", strings.Join(descriptions, "; ")) |
| 22 | } |
| 23 | if appsecurity.IsDangerous(command) { |
| 24 | return fmt.Errorf("Inline shell command matches a dangerous pattern.") |
| 25 | } |
| 26 | valid, invalidPaths := bashpkg.ValidatePaths(command, cwd) |
| 27 | if !valid { |
| 28 | if len(invalidPaths) > 5 { |
| 29 | invalidPaths = invalidPaths[:5] |
| 30 | } |
| 31 | return fmt.Errorf("Inline shell command references paths outside the workspace: %s", strings.Join(invalidPaths, ", ")) |
| 32 | } |
| 33 | return nil |
| 34 | } |