Function sanitizeCommand

apps/sim/app/api/tools/ssh/utils.ts:254–279

(command: string)

 * ```
 */
export function sanitizeCommand(command: string): string {
  let sanitized = command.replace(/\0/g, '')

  sanitized = sanitized.replace(/[\x0B\x0C]/g, '')

  sanitized = sanitized.trim()

  const dangerousPatterns = [
    { pattern: /\$\(.*\)/, name: 'command substitution $()' },
    { pattern: /`.*`/, name: 'backtick command substitution' },
    { pattern: /;\s*rm\s+-rf/i, name: 'destructive rm -rf command' },
    { pattern: /;\s*dd\s+/i, name: 'dd command (disk operations)' },
    { pattern: /mkfs/i, name: 'filesystem formatting command' },
    { pattern: />\s*\/dev\/sd[a-z]/i, name: 'direct disk write' },
  ]

  for (const { pattern, name } of dangerousPatterns) {
    if (pattern.test(sanitized)) {
      logger.warn(`Command contains ${name}`, {
        command: sanitized.substring(0, 100) + (sanitized.length > 100 ? '...' : ''),
      })
    }
  }

  return sanitized
}

/**
 * Sanitize and validate file path to prevent path traversal attacks