WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-09-20 16:47:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

Browse Source 
- orchestrate-codex-worker: drop yolo, default never approval, worktree containment
- run-with-flags-shell: add path traversal containment mirroring JS guard
- mcp-health-check: gate workspace probe, denylist dangerous env, shell-free reconnect with opt-in
- install.sh/ps1: add --ignore-scripts to block postinstall RCE
- git hooks: refuse global hooksPath clobber, remove file disable bypass, gate pre-push repo script execution
- claw.js: remove Windows shell:true, validate model token
- tests: opt into new secure defaults, quote-aware reconnect parsing
This commit is contained in:
Geronimo
2026-09-14 13:24:58 +05:30
parent 8321021c54
commit 27667bc746
10 changed files with 231 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/codex/install-global-git-hooks.sh
+16 -4
View File
@@ -54,12 +54,24 @@ run_or_echo chmod +x "$DEST_DIR/pre-commit" "$DEST_DIR/pre-push"
if [[ "$MODE" == "apply" ]]; then
prev_hooks_path="$(git config --global core.hooksPath || true)"
if [[ -n "$prev_hooks_path" ]]; then
log "Previous global hooksPath: $prev_hooks_path"
if [[ -n "$prev_hooks_path" && "$prev_hooks_path" != "$DEST_DIR" ]]; then
# SECURITY: never silently displace another tool's global hooks — that
# turns every commit/push in every repo into ECC code execution and breaks
# the user's existing security controls. Require explicit opt-in to replace.
if [[ "${ECC_FORCE_GLOBAL_HOOKS:-0}" != "1" ]]; then
log "ERROR: global core.hooksPath already set to: $prev_hooks_path"
log "Refusing to overwrite. Options:"
log " 1) Per-repo install (recommended): git config core.hooksPath \"$DEST_DIR\""
log " 2) Force replace: ECC_FORCE_GLOBAL_HOOKS=1 $0"
log " 3) Restore afterwards: git config --global core.hooksPath \"$prev_hooks_path\""
exit 1
fi
log "WARNING: replacing previous global hooksPath: $prev_hooks_path (ECC_FORCE_GLOBAL_HOOKS=1)"
log "Restore with: git config --global core.hooksPath \"$prev_hooks_path\""
fi
fi
run_or_echo git config --global core.hooksPath "$DEST_DIR"
log "Installed ECC global git hooks."
log "Disable per repo by creating .ecc-hooks-disable in project root."
log "Temporary bypass: ECC_SKIP_PRECOMMIT=1 or ECC_SKIP_PREPUSH=1"
log "Per-repo alternative (recommended): git config core.hooksPath \"$DEST_DIR\""
log "Temporary bypass (audible): ECC_SKIP_GIT_HOOKS=1 (logs a warning to stderr)"