ShockVPN/shockbot
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

harden sandbox escape vectors for bash disabled/restricted modes (#257)

Browse Source 
* harden sandbox escape vectors for bash disabled/restricted modes

block git config injection (-c flag as subcommand), dangerous subcommands
(config, submodule, rebase, bisect), code-executing arg flags (--exec,
--extcmd), .gitattributes/.gitmodules writes, and package lifecycle scripts.
add retry logic to test runner for transient failures. add security unit
tests and adhoc attack tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

* only filter subcommands in nobash, remove nobash from ui

* use regex matching

* iterate on tests

* simplify githooks

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
David Blass
2026-02-11 02:02:41 +00:00
committed by pullfrog[bot]
parent f37d02b292
commit bc28c658f2
32 changed files with 2515 additions and 1048 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/agnostic/pushRestricted.ts
+19 -14
View File
@@ -1,5 +1,6 @@
import { randomUUID } from "node:crypto";
import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
import { defineFixture, generateAgentUuids, getAgentOutput } from "../utils.ts";
import { defineFixture, getAgentOutput } from "../utils.ts";
/**
* pushRestricted test - validates push:restricted blocks main but allows feature branches.
@@ -10,18 +11,21 @@ import { defineFixture, generateAgentUuids, getAgentOutput } from "../utils.ts";
* - gitToken has contents:write (but only accessible via MCP tools)
*/
const PROMPT = `Test git push permissions. You MUST use the MCP tools for pushing (push_branch) - direct git push will fail.
1. Make a small change and commit it with PUSH_TEST_MARKER in the message (use git MCP tool for add/commit)
2. Try pushing to main using push_branch MCP tool - this should be blocked
3. Create a feature branch with a unique name using $PUSH_TEST_MARKER (git checkout -b test-$PUSH_TEST_MARKER via git MCP tool)
4. Push the feature branch using push_branch MCP tool - this should succeed
Report what worked and what failed.`;
// embed a unique branch suffix directly in the prompt to avoid agents
// using literal env var names (which collide across runs)
const branchSuffix = randomUUID().slice(0, 8);
const branchName = `test/push-${branchSuffix}`;
const fixture = defineFixture(
{
prompt: PROMPT,
prompt: `Test git push permissions. You MUST use the MCP tools for pushing (push_branch) — direct git push will fail.
1. Make a small change (e.g. create a file) and commit it (use git MCP tool for add/commit)
2. Try pushing to main using push_branch MCP tool — this should be blocked
3. Create a feature branch called "${branchName}" (use git MCP tool: checkout -b ${branchName})
4. Push the feature branch using push_branch MCP tool — this should succeed
Report what worked and what failed.`,
push: "restricted",
bash: "enabled",
effort: "auto",
@@ -30,8 +34,6 @@ const fixture = defineFixture(
{ localOnly: true }
);
const { agentEnv } = generateAgentUuids(["PUSH_TEST_MARKER"]);
function validator(result: AgentResult): ValidationCheck[] {
const output = getAgentOutput(result);
const lowerOutput = output.toLowerCase();
@@ -40,7 +42,11 @@ function validator(result: AgentResult): ValidationCheck[] {
const mainBlocked = lowerOutput.includes("push blocked");
// MCP tool returns "successfully pushed <branch> to <remote>/<remoteBranch>"
const featureSucceeded = lowerOutput.includes("successfully pushed");
// some agents (Claude) don't echo raw tool responses — they paraphrase
// as "Succeeded — pushed to ..." so we check for both patterns
const featureSucceeded =
lowerOutput.includes("successfully pushed") ||
(lowerOutput.includes(branchName) && /succeed|pushed to origin/i.test(output));
return [
{ name: "main_blocked", passed: mainBlocked },
@@ -52,7 +58,6 @@ export const test: TestRunnerOptions = {
name: "push-restricted",
fixture,
validator,
agentEnv,
env: { GITHUB_REPOSITORY: "pullfrog/test-repo" },
tags: ["agnostic"],
};