Conserve memory when resolving paths, recursively handle symlinks, check methods now more verbose and granular.#18

Open

LucasFaudman wants to merge 20 commits intopixee:mainfrom

LucasFaudman:main

Commits on Feb 10, 2024

Fixed all command injection vulnerabilites present in previous implementation by properly handling globbing, chained commands via other binaries, directory traversal and missing of banned binaries …

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Feb 13, 2024

Correctly handle $IFS/${IFS} in commands. check_banned_executable can use precomputed abs_path_strings for .endswith check

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Feb 15, 2024

Tests now check err.value.args[0].startswith(<Expected Exception Message>) not == since my execptions have slighly different message format but the check is still the exact same

Lucas Faudman
authored and
Lucas Faudman
committed
Convert to Pytest. Add shell expansion tests, nested shell syntax test and FuzzDB tests

Lucas Faudman
authored and
Lucas Faudman
committed
Correctly handle all shell expansions. Correctly handled deeply nested shell syntax with recursive_shlex_split. Compatible with Python3.8

Lucas Faudman
authored and
Lucas Faudman
committed
Convert to Pytest. Add shell expansion tests, nested shell syntax test and FuzzDB tests

Lucas Faudman
authored and
Lucas Faudman
committed
Handle all shell redirection operators

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Feb 16, 2024

handle arithmetic expansion of bracket paramters and nested expansions

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Feb 23, 2024

- Complete Shell param/brace/sequence expansion for all ALLOWED_SHELL_EXPANSION_OPERATORS.

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Feb 27, 2024

Remove redundant rmtree, remove script* and add time to BANNED_COMMAND_CHAINING_EXECUTABLES

Lucas Faudman
authored and
Lucas Faudman
committed
- check() now uses Popen kwargs to determine the initial env state and if shell expansion is needed.

Lucas Faudman
authored and
Lucas Faudman
committed
Remove unused os.environ import left by mistake

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Mar 5, 2024

Add FuzzDB license.

Lucas Faudman
authored and
Lucas Faudman
committed
remove unnessary list conversion

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Mar 6, 2024

- Optimized space complexity of command parsing and path resolution by converting _resolve_path_in_parsed_command to a generator of Path objects that takes a single cmd_part and yields all the reso…

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Mar 7, 2024

cleanup comments

Lucas Faudman
authored and
Lucas Faudman
committed
Improve readability. (Underlying check logic unchanged)

Lucas Faudman
authored and
Lucas Faudman
committed
Same check logic but more verbose readable code.

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Mar 12, 2024

- Generators used when resolving paths to avoid storing paths all in memory at once.

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Mar 13, 2024

Fix sonarcloud Intentionality & Consistency issues from last PR

Lucas Faudman
authored and
Lucas Faudman
committed