Skip to content

Add tests for user-reported rm security bypass variants #48647

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rtfeldman merged 4 commits into from
Feb 6, 2026
Merged

Add tests for user-reported rm security bypass variants #48647

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8d7b614
Strengthen hardcoded rm security rules and add path normalization
rtfeldman Feb 6, 2026
fcf15b6
Merge remote-tracking branch 'origin/main' into pr/rm-security-rules-…
rtfeldman Feb 6, 2026
89344f4
Add tests for user-reported rm security bypass variants
rtfeldman Feb 6, 2026
073f116
Merge remote-tracking branch 'origin/main' into more-security-tests
rtfeldman Feb 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions crates/agent/src/tool_permissions.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1356,6 +1356,10 @@ mod tests {
// End-of-options marker
t("rm -rf -- /").is_deny();
t("rm -- /").is_deny();
// Prefixed with sudo or other commands
t("sudo rm -rf /").is_deny();
t("sudo rm -rf /*").is_deny();
t("sudo rm -rf --no-preserve-root /").is_deny();
}

#[test]
Expand Down Expand Up @@ -1540,21 +1544,37 @@ mod tests {
t("rm --no-preserve-root=yes -rf .").is_deny();
t("rm --no-preserve-root=yes -rf ..").is_deny();
t("rm --no-preserve-root=yes -rf $HOME").is_deny();
// --flag (without =value) should also not bypass the rules
t("rm -rf --no-preserve-root /").is_deny();
t("rm --no-preserve-root -rf /").is_deny();
t("rm --no-preserve-root --recursive --force /").is_deny();
t("rm -rf --no-preserve-root ~").is_deny();
t("rm -rf --no-preserve-root .").is_deny();
t("rm -rf --no-preserve-root ..").is_deny();
t("rm -rf --no-preserve-root $HOME").is_deny();
// Trailing --flag=value after path
t("rm / --no-preserve-root=yes -rf").is_deny();
t("rm ~ -rf --no-preserve-root=yes").is_deny();
// Trailing --flag (without =value) after path
t("rm / -rf --no-preserve-root").is_deny();
t("rm ~ -rf --no-preserve-root").is_deny();
// Safe paths with --flag=value should NOT be blocked
t("rm --no-preserve-root=yes -rf ./build")
.mode(ToolPermissionMode::Allow)
.is_allow();
t("rm --interactive=never -rf /tmp/test")
.mode(ToolPermissionMode::Allow)
.is_allow();
// Safe paths with --flag (without =value) should NOT be blocked
t("rm --no-preserve-root -rf ./build")
.mode(ToolPermissionMode::Allow)
.is_allow();
}

#[test]
fn hardcoded_blocks_rm_with_path_traversal() {
// Traversal to root via ..
t("rm -rf /etc/../").is_deny();
t("rm -rf /tmp/../../").is_deny();
t("rm -rf /tmp/../..").is_deny();
t("rm -rf /var/log/../../").is_deny();
Expand Down Expand Up @@ -1620,6 +1640,26 @@ mod tests {
t("rm -rf /safe /var/log/../../").is_deny();
}

#[test]
fn hardcoded_blocks_user_reported_bypass_variants() {
// User report: "rm -rf /etc/../" normalizes to "rm -rf /" via path traversal
t("rm -rf /etc/../").is_deny();
t("rm -rf /etc/..").is_deny();
// User report: --no-preserve-root (without =value) should not bypass
t("rm -rf --no-preserve-root /").is_deny();
t("rm --no-preserve-root -rf /").is_deny();
// User report: "rm -rf /*" should be caught (glob expands to all top-level entries)
t("rm -rf /*").is_deny();
// Chained with sudo
t("sudo rm -rf /").is_deny();
t("sudo rm -rf --no-preserve-root /").is_deny();
// Traversal cannot be bypassed even with global allow or allow patterns
t("rm -rf /etc/../").global(true).is_deny();
t("rm -rf /etc/../").allow(&[".*"]).is_deny();
t("rm -rf --no-preserve-root /").global(true).is_deny();
t("rm -rf --no-preserve-root /").allow(&[".*"]).is_deny();
}

#[test]
fn normalize_path_relative_no_change() {
assert_eq!(normalize_path("foo/bar"), "foo/bar");
Expand Down