62 lines
1.8 KiB
Python
62 lines
1.8 KiB
Python
"""Run with python3; command payloads are inspected, never executed."""
|
|
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import subprocess
|
|
|
|
|
|
hook = Path(__file__).with_name("block-dangerous-git.sh")
|
|
|
|
|
|
def check(payload, expected, env=None):
|
|
result = subprocess.run(
|
|
["/bin/bash", str(hook)], input=payload, text=True, capture_output=True, env=env
|
|
)
|
|
assert result.returncode == expected, (payload, result.returncode, result.stderr)
|
|
if expected == 2:
|
|
assert result.stderr.startswith("BLOCKED:"), result.stderr
|
|
|
|
|
|
for command in (
|
|
"git push origin main",
|
|
"git push --force-with-lease origin main",
|
|
"git -C /tmp/example push origin main",
|
|
"git -c core.pager=cat --no-pager push",
|
|
"git --git-dir=/tmp/example push",
|
|
"git push",
|
|
"git status;git push",
|
|
"git status\ngit push",
|
|
"git \\\npush origin main",
|
|
"git pu\\\nsh origin main",
|
|
"git reset --ha\\\nrd HEAD",
|
|
"git reset --hard HEAD",
|
|
"git clean -xdf",
|
|
"git clean --force",
|
|
"git branch -D topic",
|
|
"git branch -df topic",
|
|
"git branch -vD topic",
|
|
"git branch --delete --force topic",
|
|
"git checkout -- .",
|
|
"git restore .",
|
|
):
|
|
check(json.dumps({"tool_input": {"command": command}}), 2)
|
|
|
|
for command in (
|
|
"git status",
|
|
"git diff",
|
|
"git -C /tmp/example status",
|
|
"git branch -d merged-topic",
|
|
"git reset --soft HEAD~1",
|
|
"echo 'git push origin main'",
|
|
'echo ""',
|
|
"git reset --soft HEAD; echo --hard",
|
|
):
|
|
check(json.dumps({"tool_input": {"command": command}}), 0)
|
|
|
|
for payload in ("", "{", "{}", "[]", '{"tool_input":{"command":null}}'):
|
|
check(payload, 2)
|
|
check('{"tool_input":{"command":"git status"}}', 2, {**os.environ, "PATH": ""})
|
|
check('{"tool_input":{"command":"git \\\""}}', 2)
|
|
print("Guardrail checks passed")
|