Strengthen hardcoded rm security rules and add path normalization#48640
Merged
Strengthen hardcoded rm security rules and add path normalization#48640
Conversation
- Add normalize_path function to resolve .., ., and redundant separators
- Add decide_permission_for_path wrapper that normalizes before checking
- Add expand_rm_to_single_path_commands to handle multi-path rm commands
- Normalize paths in rm commands before checking hardcoded security rules
- Normalize suffix after $HOME/${HOME} variable references
- Handle -- end-of-options marker in rm commands
- Handle trailing flags after path operand (GNU rm accepts this)
- Broaden FLAGS regex to accept digits, underscores, and uppercase
- Handle tabs/any whitespace after rm command name
- Preserve .. components that traverse above start path
- Preserve leading / for absolute paths in normalize_path
- Extensive test coverage for all edge cases
naaiyy
added a commit
to Glass-HQ/Glass
that referenced
this pull request
Feb 16, 2026
Key changes: - LSP folding ranges support (zed-industries#48611) - textDocument/foldingRange with custom fold text - LSP refactoring (zed-industries#48604) - extracted document_colors, code_lens, folding_ranges into modules - Crate graph restructuring (zed-industries#48602) - terminal moved closer to editor - Side-by-side diff searching (zed-industries#48539) and OpenExcerpts for LHS (zed-industries#48438) - SplittableEditor: sync custom blocks between RHS/LHS (zed-industries#48575) - Thinking effort for Zed/OpenAI providers (zed-industries#48545, zed-industries#48605) - Agent default_model.enable_thinking setting (zed-industries#48536) - Configurable LSP timeout setting (zed-industries#44745) - PaneSearchBarCallbacks global (search bar setup extracted from vim) - Settings migrations for nested platform/channel/profile keys (zed-industries#48550) - Shell parser: I/O redirects, here-documents, compound commands (zed-industries#48635) - Hardened tool authorization: sensitive settings, deferred ops (zed-industries#48641) - rm security bypass fixes (zed-industries#48640, zed-industries#48647) - MCP tool name parsing fix: newline delimiter (zed-industries#48636) - Canonicalize --user-data-dir path (zed-industries#48470) - Fix text_threads_dir XDG spec compliance (zed-industries#45771) - Buffer font for folds (zed-industries#48652) - Multibuffer toolbar layout shift fix (zed-industries#48472) - Editor: tabs bitmask syncing (zed-industries#48366) Conflict resolution: - collab tests: deleted (collab removed) - util/archive.rs, util/shell.rs: deleted (extracted to Obsydian) - copilot_ui/sign_in.rs: kept native_button style - editor_tests.rs: merged imports (kept MoveItemToPaneInDirection, added ViewId/FollowEvent) - lsp_store.rs: took upstream refactored imports, added FoldingRangeData, removed collab imports - main.rs: added PaneSearchBarCallbacks, removed vim::init Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR hardens the terminal tool's hardcoded security rules for destructive commands like
rm -rf /, and adds path normalization to prevent traversal-based bypasses.Path normalization
Adds
normalize_pathwhich resolves..,., and redundant path separators, anddecide_permission_for_pathwhich checks permissions against both raw and normalized paths (taking the most restrictive result). This prevents attacks likerm -rf /tmp/../../which previously bypassed therm -rf /rule.rm command expansion
Adds
expand_rm_to_single_path_commandswhich splits multi-argument rm commands into individual single-path commands for checking. This catches cases likerm -rf /tmp /where the dangerous path is the second argument.Regex hardening
--no-preserve-root)--flag=value: Correctly matched as a single flag tokenrm / -rf)--marker: Detects end-of-options bypass attempts (e.g.rm -rf -- /)$HOME/${HOME}handlingNormalizes the suffix after
$HOME/${HOME}variable references so that traversal attacks likerm -rf $HOME/./orrm -rf ${HOME}/foo/..are correctly detected.Release Notes:
rm -rf.