WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-09-20 16:47:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

Browse Source 
- orchestrate-codex-worker: drop yolo, default never approval, worktree containment
- run-with-flags-shell: add path traversal containment mirroring JS guard
- mcp-health-check: gate workspace probe, denylist dangerous env, shell-free reconnect with opt-in
- install.sh/ps1: add --ignore-scripts to block postinstall RCE
- git hooks: refuse global hooksPath clobber, remove file disable bypass, gate pre-push repo script execution
- claw.js: remove Windows shell:true, validate model token
- tests: opt into new secure defaults, quote-aware reconnect parsing
This commit is contained in:
Geronimo
2026-09-14 13:24:58 +05:30
parent 8321021c54
commit 27667bc746
10 changed files with 231 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/codex-git-hooks/pre-commit
+4 -3
View File
@@ -5,12 +5,13 @@ set -euo pipefail
# Blocks commits that add high-signal secrets.
if [[ "${ECC_SKIP_GIT_HOOKS:-0}" == "1" || "${ECC_SKIP_PRECOMMIT:-0}" == "1" ]]; then
printf '[ECC pre-commit] WARNING: hook bypassed via env (ECC_SKIP_*=1)\n' >&2
exit 0
fi
if [[ -f ".ecc-hooks-disable" || -f ".git/ecc-hooks-disable" ]]; then
exit 0
fi
# NOTE: file-based disables (.ecc-hooks-disable) were removed — a malicious
# repo could ship that file and silently turn off secret scanning exactly
# where it is most needed. Use the env bypass above (audible warning) instead.
if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
exit 0
scripts/codex-git-hooks/pre-push
+20 -5
View File
@@ -5,12 +5,12 @@ set -euo pipefail
# Runs a lightweight verification flow before pushes.
if [[ "${ECC_SKIP_GIT_HOOKS:-0}" == "1" || "${ECC_SKIP_PREPUSH:-0}" == "1" ]]; then
printf '[ECC pre-push] WARNING: hook bypassed via env (ECC_SKIP_*=1)\n' >&2
exit 0
fi
if [[ -f ".ecc-hooks-disable" || -f ".git/ecc-hooks-disable" ]]; then
exit 0
fi
# NOTE: file-based disables (.ecc-hooks-disable) were removed — a malicious
# repo could ship that file and silently disable verification.
if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
exit 0
@@ -85,8 +85,14 @@ run_node_script() {
}
if [[ -f "package.json" ]]; then
pm="$(detect_pm)"
log "Node project detected (package manager: $pm)"
# SECURITY: executing a cloned repo's lint/test/build scripts on push is
# arbitrary code execution (package.json scripts run as you). Opt-in only:
# set ECC_PREPUSH_RUN_CHECKS=1 for repos you trust.
if [[ "${ECC_PREPUSH_RUN_CHECKS:-0}" != "1" ]]; then
log "Node project detected but ECC_PREPUSH_RUN_CHECKS!=1; skipping repo script execution (set =1 to opt in)."
else
pm="$(detect_pm)"
log "Node project detected (package manager: $pm)"
for script_name in lint typecheck test build; do
if has_node_script "$script_name"; then
@@ -109,8 +115,12 @@ if [[ -f "package.json" ]]; then
*) npm audit --omit=dev || fail "npm audit failed" ;;
esac
fi
fi
fi
# SECURITY: go test / pytest execute repo-controlled code (TestMain,
# conftest.py). Same opt-in gate as Node scripts above.
if [[ "${ECC_PREPUSH_RUN_CHECKS:-0}" == "1" ]]; then
if [[ -f "go.mod" ]] && command -v go >/dev/null 2>&1; then
ran_any_check=1
log "Go project detected. Running: go test ./..."
@@ -126,6 +136,11 @@ if [[ -f "pyproject.toml" || -f "requirements.txt" ]]; then
log "Python project detected but pytest is not installed. Skipping."
fi
fi
else
if [[ -f "go.mod" || -f "pyproject.toml" || -f "requirements.txt" ]]; then
log "Go/Python project detected but ECC_PREPUSH_RUN_CHECKS!=1; skipping test execution."
fi
fi
if [[ "$ran_any_check" -eq 0 ]]; then
log "No supported checks found in this repository. Skipping."