class

Autobot::Tools::ExecTool

Inherits Autobot::Tools::Tool < Reference < Object

Tool to execute shell commands with safety guards.

Constants

DEFAULT_DENY_PATTERNS = [/\bln\s+/i, /\bcp\s+.*-[a-z]*l/i, /\bcp\s+--link/i, /\brm\s+-[rf]{1,2}\b/i, /\brm\s+-r\s+-f\b/i, /\bdel\s+\/[fq]\b/i, /\brmdir\s+\/s\b/i, /\b(format|mkfs|diskpart)\b/i, /\bdd\s+if=/i, />\s*\/dev\/sd/, /\b(shutdown|reboot|poweroff|halt|init\s+0)\b/i, /:\(\)\s*\{.*\};\s*:/, /\bwhile\s+true\b/i, /\|\s*(bash|sh|zsh|fish|csh)\b/i, /\bcurl\s+.*\|\s*(bash|sh)/i, /\bwget\s+.*\|\s*(bash|sh)/i, /\b(curl|wget)\s+.*-O.*\|\s*sh\b/i, /\bpython\s+-c\b/i, /\bperl\s+-e\b/i, /\bruby\s+-e\b/i, /\bnode\s+-e\b/i, /\beval\s+/i, /\bexec\s+/i, /\b(nc|ncat|netcat)\s+/i, /\bsocat\s+/i, /\bsudo\s+/i, /\bsu\s+/i, /\bchmod\s+[+]?[xs]/i, /\bchown\s+root\b/i, /\bcrontab\s+/i, />\s*\/etc\//, /\bsystemctl\s+/i, /\bgdb\s+/i, /\bstrace\s+/i, /\bltrace\s+/i]

Deny patterns for dangerous operations (defense-in-depth)

DEFAULT_TIMEOUT = 60

Log = ::Log.for(self)

MAX_OUTPUT_SIZE = 10000

SIGNAL_GRACE_PERIOD = 0.5.seconds

Constructors

new(executor : SandboxExecutor, timeout : Int32 = DEFAULT_TIMEOUT, working_dir : String | Nil = nil, deny_patterns : Array(Regex) = DEFAULT_DENY_PATTERNS, allow_patterns : Array(Regex) = [] of Regex, sandbox_config : String = "auto")

Source