opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix merge test error

Browse source
This commit is contained in:
qhxin 2026-02-18 22:30:07 +08:00
parent 057c9a3775
commit 2bfc3c1d12
3 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
pkg/tools/filesystem_test.go
View file

@ -385,9 +385,10 @@ func TestFilesystemTool_ReadFile_RejectsSymlinkEscape(t *testing.T) {
t.Skipf("symlink not supported in this environment: %v", err) t.Skipf("symlink not supported in this environment: %v", err)
} }
tool := NewReadFileTool(workspace, true) tool := NewReadFileToolWithPolicy(workspace, true, PathPolicyOpts{PathMode: security.ModeBlock})
relPath, _ := filepath.Rel(workspace, link)
result := tool.Execute(context.Background(), map[string]interface{}{ result := tool.Execute(context.Background(), map[string]interface{}{
"path": link, "path": relPath,
}) })
if !result.IsError { if !result.IsError {

7
pkg/tools/shell.go
View file

@ -65,6 +65,13 @@ var defaultDenyPatterns = []*regexp.Regexp{
regexp.MustCompile(`\bpkill\b`), regexp.MustCompile(`\bpkill\b`),
regexp.MustCompile(`\bkillall\b`), regexp.MustCompile(`\bkillall\b`),
regexp.MustCompile(`\bkill\s+-[9]\b`), regexp.MustCompile(`\bkill\s+-[9]\b`),
regexp.MustCompile(`\bcurl\b.*\s+(-d|--data|--data-raw|--data-binary|-F|--form|-T|--upload-file)\b`),
regexp.MustCompile(`\bwget\b.*\s+(--post-data|--post-file)\b`),
regexp.MustCompile(`\bnc\b\s+\S+\s+\d+`),
regexp.MustCompile(`\bncat\b\s+\S+\s+\d+`),
regexp.MustCompile(`base64\b.*\|\s*(sh|bash|zsh)\b`),
regexp.MustCompile(`\b(bash|sh|zsh)\s+-i\s+[>&]`),
regexp.MustCompile(`/dev/tcp/`),
regexp.MustCompile(`\bcurl\b.*\|\s*(sh|bash)`), regexp.MustCompile(`\bcurl\b.*\|\s*(sh|bash)`),
regexp.MustCompile(`\bwget\b.*\|\s*(sh|bash)`), regexp.MustCompile(`\bwget\b.*\|\s*(sh|bash)`),
regexp.MustCompile(`\bnpm\s+install\s+-g\b`), regexp.MustCompile(`\bnpm\s+install\s+-g\b`),

2
pkg/tools/shell_test.go
View file

@ -215,7 +215,7 @@ func TestShellTool_RestrictToWorkspace(t *testing.T) {
// TestShellTool_DataExfiltrationBlocked verifies data exfiltration patterns are blocked // TestShellTool_DataExfiltrationBlocked verifies data exfiltration patterns are blocked
// when exec_guard mode is "block". // when exec_guard mode is "block".
func TestShellTool_DataExfiltrationBlocked(t *testing.T) { func TestShellTool_DataExfiltrationBlocked(t *testing.T) {
tool := NewExecToolWithConfig("", false, ExecToolConfig{ExecGuardMode: "block"}) tool := NewExecToolWithConfig("", false, ExecToolConfig{ExecGuardMode: security.ModeBlock})
ctx := context.Background() ctx := context.Background()
dangerousCmds := []string{ dangerousCmds := []string{