kenryu42/cc-safety-net v2.6.13

on GitHub

This release closes several ways a dangerous command could reach the shell unchecked: commands sent by Amp bypassing the secret, policy and Git-metadata guards, shell options that look like a syntax check but still execute, ambiguous -c option clusters, and Git discard relaxations in repositories that can redirect Git elsewhere. Commands containing a carriage return or an unquoted Unicode blank are now refused as unparseable.

Highlights

• Fixed a bypass in Amp, whose Bash tool sends the command outside input.command: cat .env, cat ~/.ssh/id_rsa, a redirect into the user policy file and a write under .git/hooks were allowed at every safety level. The secret, policy-config, policy-apply and Git-metadata guards now read the command that will actually run. (#264)
• Improved the shell syntax-check exemption, which allowed invocations that still execute their -c body, such as zsh -n -o exec -c '<cmd>', bash -nc +n '<cmd>' and ksh -n --exec -c '<cmd>'. The exemption now holds only when every option word is -n or -c; anything else is analyzed normally. (#267)

Changed

• Changed auto shell mode to evaluate both readings of a command that it guesses is PowerShell: the command is denied when either the PowerShell or the POSIX reading denies. (#265)
• Changed cc-safety-net explain to report the trace of the shell reading that produced the decision instead of mixing both readings. (#265)
• Changed Git discard relaxations for disposable temporary repositories and linked worktrees to be withheld when the repository can send Git elsewhere — a core.worktree setting in the command, the shared config or config.worktree, a symlink or FIFO inside the Git directory, or a HEAD in an ancestor directory. Force-clean and discard commands in such a repository are blocked at standard and strict safety. (#269)
• Changed command parsing to refuse a carriage return, vertical tab or form feed anywhere in a POSIX-parsed command, at every safety level. Heredoc bodies with CRLF line endings that were previously allowed are now blocked. (#268)

Fixed

• Fixed shell argv whose -c cluster hides the real command string being allowed — bash -c -x '<cmd>', sh -c - '<cmd>', dash -oc pipefail '<cmd>', ksh -oc '<cmd>', zsh -ocorrect -c '<cmd>' and any argv containing a + option word. These are now refused because the command string cannot be identified, including through xargs, parallel, find -exec and heredocs. Real syntax checks such as bash -n script.sh and bash -n -c '<cmd>', and bash -o pipefail -c 'echo ok', stay allowed. (#267)
• Fixed unquoted Unicode blanks being treated as word separators when bash and zsh keep them inside a word, so a command such as rm<NBSP>-rf /tmp/x was analyzed differently from how the shell runs it. Non-breaking space, U+3000, U+2000–U+200A, U+202F, U+205F, the byte order mark and others are now refused; a blank inside quotes or a heredoc body is still allowed, so quoted non-ASCII text such as a commit message is unaffected. (#268)