Richard Feldman 7fa4cfcfed
Strengthen hardcoded rm security rules and add path normalization ( #48640 ) ...
This PR hardens the terminal tool's hardcoded security rules for
destructive commands like `rm -rf /`, and adds path normalization to
prevent traversal-based bypasses.
## Path normalization
Adds `normalize_path` which resolves `..`, `.`, and redundant path
separators, and `decide_permission_for_path` which checks permissions
against both raw and normalized paths (taking the most restrictive
result). This prevents attacks like `rm -rf /tmp/../../` which
previously bypassed the `rm -rf /` rule.
## rm command expansion
Adds `expand_rm_to_single_path_commands` which splits multi-argument rm
commands into individual single-path commands for checking. This catches
cases like `rm -rf /tmp /` where the dangerous path is the second
argument.
## Regex hardening
- **FLAGS**: Now accepts digits, underscores, and uppercase in long
flags (e.g. `--no-preserve-root`)
- **`--flag=value`**: Correctly matched as a single flag token
- **Trailing flags**: Handles GNU rm's acceptance of flags after path
operands (e.g. `rm / -rf`)
- **`--` marker**: Detects end-of-options bypass attempts (e.g. `rm -rf
-- /`)
- **Whitespace**: Handles tabs and other whitespace, not just spaces
## `$HOME`/`${HOME}` handling
Normalizes the suffix after `$HOME`/`${HOME}` variable references so
that traversal attacks like `rm -rf $HOME/./` or `rm -rf ${HOME}/foo/..`
are correctly detected.
Release Notes:
- Strengthened terminal security rules to detect path traversal attacks
in destructive commands like `rm -rf`.
2026-02-06 17:17:43 -05:00
2026-02-06 14:03:03 -05:00
2026-01-21 13:40:42 -03:00
2026-01-22 02:31:14 -05:00
2026-01-15 15:21:57 +00:00
2026-02-06 17:17:43 -05:00
2026-02-04 13:12:49 +00:00
2026-02-05 23:35:44 +00:00
2026-02-06 22:24:38 +02:00
2026-02-04 18:51:57 +01:00
2026-01-28 21:34:10 +00:00
2026-02-06 21:49:14 +00:00
2026-01-30 21:26:13 +00:00
2025-10-17 18:58:14 +00:00
2026-01-26 23:56:55 +00:00
2026-02-06 20:14:35 +01:00
2026-02-06 20:14:35 +01:00
2026-01-07 12:48:24 -08:00
2026-01-26 07:25:51 +00:00
2025-11-11 12:55:19 +00:00
2026-01-15 15:21:57 +00:00
2025-10-17 18:58:14 +00:00
2025-12-17 12:54:57 +01:00
2026-02-06 20:21:19 +00:00
2026-02-05 20:10:02 +00:00
2026-01-07 12:48:24 -08:00
2026-01-07 12:48:24 -08:00
2026-01-30 10:14:36 +01:00
2026-01-28 18:28:53 +00:00
2025-11-06 09:16:45 +00:00
2025-11-10 23:00:55 -07:00
2026-01-28 21:34:10 +00:00
2026-02-06 14:03:03 -05:00
2026-02-05 17:34:34 -05:00
2026-02-06 18:06:01 +00:00
2026-02-04 19:31:25 +00:00
2025-10-17 18:58:14 +00:00
2026-01-14 07:19:13 +00:00
2025-10-17 18:58:14 +00:00
2025-10-17 18:58:14 +00:00
2026-01-23 18:29:20 +01:00
2026-01-30 21:26:13 +00:00
2026-02-04 17:54:11 -05:00
2026-02-06 03:34:34 +00:00
2026-02-05 22:04:21 +00:00
2026-01-14 07:19:13 +00:00
2026-01-07 12:48:24 -08:00
2026-01-28 16:00:52 +00:00
2026-02-04 04:44:42 -05:00
2025-10-17 18:58:14 +00:00
2026-01-14 07:19:13 +00:00
2026-01-07 12:48:24 -08:00
2026-02-05 10:37:39 +00:00
2025-12-18 12:47:34 +00:00
2025-10-17 18:58:14 +00:00
2026-02-04 10:48:40 -08:00
2026-02-06 20:21:19 +00:00
2026-02-04 17:37:13 +00:00
2026-02-06 16:11:40 -05:00
2026-02-06 00:31:24 -08:00
2026-01-16 02:16:34 +00:00
2026-02-04 17:54:11 -05:00
2026-02-06 21:46:27 +00:00
2026-02-06 22:24:38 +02:00
2026-01-27 05:27:26 +00:00
2026-02-06 01:04:53 +00:00
2025-12-18 17:26:20 +01:00
2025-10-17 18:58:14 +00:00
2026-02-04 23:03:15 +01:00
2026-02-05 12:13:02 +00:00
2026-01-28 14:25:47 +01:00
2026-02-05 12:13:02 +00:00
2026-01-28 10:28:43 +01:00
2026-02-06 16:11:32 +00:00
2025-10-17 18:58:14 +00:00
2026-02-06 07:02:06 +00:00
2025-10-17 18:58:14 +00:00
2026-01-30 09:42:28 +01:00
2025-10-20 10:30:06 +00:00
2025-12-08 19:50:20 +01:00
2026-02-03 04:24:11 +00:00
2026-01-31 13:49:42 -05:00
2026-01-31 21:56:34 +00:00
2026-02-06 12:03:52 -05:00
2026-01-27 05:51:11 +00:00
2025-12-17 20:12:40 -06:00
2026-02-05 20:28:31 +00:00
2026-01-27 15:37:22 -03:00
2026-01-07 12:48:24 -08:00
2025-10-17 18:58:14 +00:00
2025-12-09 09:29:40 -08:00
2025-10-17 18:58:14 +00:00
2026-02-05 04:15:41 +00:00
2026-02-05 09:31:11 +00:00
2026-01-23 18:29:20 +01:00
2026-01-07 12:48:24 -08:00
2025-11-19 22:00:58 +00:00
2026-02-04 23:45:52 +01:00
2026-01-23 18:29:20 +01:00
2026-02-06 16:11:40 -05:00
2026-02-04 23:03:15 +01:00
2026-02-06 14:03:03 -05:00
2026-02-06 14:03:03 -05:00
2025-10-17 18:58:14 +00:00
2026-01-23 18:29:20 +01:00
2026-02-05 15:06:02 +00:00
2026-02-05 12:23:39 +01:00
2025-10-22 19:52:38 +00:00
2026-02-03 15:51:40 -05:00
2026-01-16 14:20:23 +00:00
2025-10-17 18:58:14 +00:00
2026-02-06 22:24:38 +02:00
2026-02-02 16:37:58 +00:00
2026-01-28 00:19:13 -03:00
2025-10-17 18:58:14 +00:00
2025-12-30 07:49:01 -03:00
2026-02-06 16:50:36 +00:00
2026-01-14 07:19:13 +00:00
2026-02-05 17:34:34 -05:00
2026-02-05 20:10:02 +00:00
2026-01-06 08:14:34 +00:00
2025-10-17 18:58:14 +00:00
2026-01-21 14:52:44 +00:00
2026-01-07 12:48:24 -08:00
2026-02-04 01:33:12 +00:00
2026-02-05 09:31:11 +00:00
2026-01-27 13:02:40 +00:00
2026-01-31 09:57:31 +02:00
2025-11-24 13:24:26 -05:00
2026-01-14 08:06:55 -03:00
2026-01-22 11:24:23 +00:00
2026-02-02 13:30:07 +01:00
2026-02-06 15:34:36 +00:00
2026-01-23 18:29:20 +01:00
2026-01-23 18:29:20 +01:00
2026-02-04 17:37:13 +00:00
2026-02-06 22:24:38 +02:00
2026-01-20 15:41:31 -05:00
2026-02-06 18:41:08 +05:30
2026-01-14 07:19:13 +00:00
2026-01-30 21:26:13 +00:00
2026-02-06 22:24:38 +02:00
2026-02-05 22:58:55 -05:00
2025-12-15 13:30:13 +00:00
2025-11-27 13:46:43 +00:00
2026-02-04 09:15:21 +00:00
2026-02-02 13:30:07 +01:00
2026-02-03 07:12:29 +00:00
2026-02-04 07:05:22 -06:00
2026-02-04 01:33:12 +00:00
2025-11-03 19:25:15 +00:00
2026-01-20 12:23:17 +00:00
2026-02-06 18:06:01 +00:00
2026-02-06 01:04:53 +00:00
2026-01-15 18:39:06 +00:00
2025-12-16 10:48:14 -05:00
2026-02-06 20:14:35 +01:00
2026-01-14 07:19:13 +00:00
2026-02-06 18:06:01 +00:00
2026-02-06 16:11:40 -05:00
2025-10-27 10:13:26 -04:00
2025-11-21 08:28:17 -07:00
2025-11-07 22:27:14 +00:00
2026-02-06 18:36:25 +00:00
2025-10-17 18:58:14 +00:00
2026-01-26 13:49:26 +00:00
2026-01-23 18:29:20 +01:00
2025-10-17 18:58:14 +00:00
2025-10-17 18:58:14 +00:00
2025-10-17 18:58:14 +00:00
2026-01-29 16:33:38 -03:00
2025-11-03 19:25:15 +00:00
2026-02-05 20:10:02 +00:00
2026-02-04 17:54:11 -05:00
2026-01-04 23:28:18 +00:00
2026-01-28 00:19:13 -03:00
2025-11-24 13:34:04 +01:00
2026-02-05 20:25:20 +00:00
2026-02-05 10:37:39 +00:00
2026-01-26 19:47:36 +00:00
2025-11-07 11:36:05 +00:00
2026-01-28 16:36:44 -08:00
2026-01-30 21:26:13 +00:00
2026-02-06 20:14:35 +01:00
2026-02-05 20:10:02 +00:00
2026-02-04 17:37:13 +00:00
2025-10-17 18:58:14 +00:00
2026-01-15 18:10:21 +00:00
2025-12-01 20:52:57 -07:00
2026-01-28 17:05:34 +01:00
2026-02-04 03:42:35 -03:00
2026-02-02 16:56:25 +00:00
2026-02-04 16:39:41 -05:00
2026-02-02 13:30:07 +01:00
2025-10-17 18:58:14 +00:00
2025-10-17 18:58:14 +00:00
2026-02-05 22:58:55 -05:00
2025-10-17 18:58:14 +00:00
2026-01-25 21:35:32 +01:00
2026-02-05 18:57:23 +01:00
2025-11-07 22:27:14 +00:00
2025-10-17 18:58:14 +00:00
2025-10-17 18:58:14 +00:00
2026-01-23 20:50:50 +00:00
2025-12-17 11:53:48 -07:00
2026-02-06 20:14:35 +01:00
2026-02-06 07:02:06 +00:00
2026-01-29 15:31:13 +00:00
2025-12-08 16:38:34 +01:00
2026-02-06 20:14:35 +01:00
2026-02-06 20:14:35 +01:00
2025-12-13 11:06:30 -05:00
2026-02-06 00:31:24 -08:00
2025-12-06 17:56:49 +00:00
2025-11-07 22:27:14 +00:00
2026-01-17 19:29:19 +00:00
2025-12-05 17:23:06 +00:00
Richard Feldman
7fa4cfcfed