opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): ensure custom deny patterns extend defaults instead of replacing them (#479)

Browse source 
* fix (security): custom deny patterns denying default patterns

* fix formatting whitespace
This commit is contained in:
Goksu Ceylan 2026-02-23 17:02:44 -05:00 • committed by GitHub
parent 2fa51d7b86
commit 09b1992dd7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
pkg/tools/shell.go
View file

@ -81,6 +81,7 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf
execConfig := config.Tools.Exec execConfig := config.Tools.Exec
enableDenyPatterns = execConfig.EnableDenyPatterns enableDenyPatterns = execConfig.EnableDenyPatterns
if enableDenyPatterns { if enableDenyPatterns {
denyPatterns = append(denyPatterns, defaultDenyPatterns...)
if len(execConfig.CustomDenyPatterns) > 0 { if len(execConfig.CustomDenyPatterns) > 0 {
fmt.Printf("Using custom deny patterns: %v\n", execConfig.CustomDenyPatterns) fmt.Printf("Using custom deny patterns: %v\n", execConfig.CustomDenyPatterns)
for _, pattern := range execConfig.CustomDenyPatterns { for _, pattern := range execConfig.CustomDenyPatterns {
@ -91,8 +92,6 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf
} }
denyPatterns = append(denyPatterns, re) denyPatterns = append(denyPatterns, re)
} }
} else {
denyPatterns = append(denyPatterns, defaultDenyPatterns...)
} }
} else { } else {
// If deny patterns are disabled, we won't add any patterns, allowing all commands. // If deny patterns are disabled, we won't add any patterns, allowing all commands.