fix(hooks): close the five escapes the skills#52 review found
- Fail-closed path no longer needs jq: the ask JSON is a printf literal, and a host without jq asks instead of staying silent. - A tool_name that is not a non-empty string asks (was: no opinion). - Gate workflow_run_trigger, tag_create, release_create, and file_write_branch when it lands on main/master, has no branch, or empties a file (same effect as pr_merge / file_delete). - Header claim narrowed: gitea-mcp spellings on any server name, not other servers' spellings of the same operation. - Tests run the hook as hooks.json does (bash <path>), assert exit 0 on every case, and cover null/missing/wrong-type tool_name, last-segment verb parsing and a PATH without jq. 13 new cases were red first. Refs mathias/infra#508 Bump-Type: minor Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
@@ -4,9 +4,11 @@
|
||||
#
|
||||
# Contract: reads PreToolUse hook JSON on stdin, ALWAYS exits 0, and answers
|
||||
# in hookSpecificOutput.permissionDecision. "ask" = a human must approve;
|
||||
# no decision emitted ("NONE") = the guard stays out of the way and normal
|
||||
# permission rules apply. The guard never emits "allow": an allow from a hook
|
||||
# would bypass the user's own deny/ask rules.
|
||||
# empty stdout ("NONE") = no opinion, normal permission rules apply. The guard
|
||||
# never emits "allow": an allow from a hook would bypass the user's own rules.
|
||||
#
|
||||
# Cases marked (gatekeeper) are escapes found by the skills#52 review: each
|
||||
# passed the first version of this suite.
|
||||
|
||||
set -u
|
||||
|
||||
@@ -16,60 +18,82 @@ GUARD="$ROOT/hooks/mcp-destructive-guard.sh"
|
||||
pass=0
|
||||
fail=0
|
||||
|
||||
# An empty stdout is a valid hook answer ("no opinion"), reported as NONE.
|
||||
decode() {
|
||||
_out=$(cat)
|
||||
[ -z "$_out" ] && { echo NONE; return; }
|
||||
printf '%s' "$_out" | jq -r '.hookSpecificOutput.permissionDecision // "NONE"' 2>/dev/null || echo BROKEN
|
||||
# run_guard <json> [PATH] — invoked exactly as hooks.json does: `bash <path>`.
|
||||
# Prints "<decision> rc=<exit>", decision NONE for an empty answer.
|
||||
run_guard() {
|
||||
if [ $# -ge 2 ]; then
|
||||
_out=$(printf '%s' "$1" | PATH="$2" "$BASH_BIN" "$GUARD"); _rc=$?
|
||||
else
|
||||
_out=$(printf '%s' "$1" | bash "$GUARD"); _rc=$?
|
||||
fi
|
||||
if [ -z "$_out" ]; then _d=NONE
|
||||
else _d=$(printf '%s' "$_out" | jq -r '.hookSpecificOutput.permissionDecision // "NONE"' 2>/dev/null || echo BROKEN)
|
||||
fi
|
||||
printf '%s rc=%s' "$_d" "$_rc"
|
||||
}
|
||||
BASH_BIN=$(command -v bash)
|
||||
|
||||
decision_for() {
|
||||
jq -n --arg t "$1" '{tool_name: $t, tool_input: {owner: "mathias", repo: "x"}}' \
|
||||
| "$GUARD" | decode
|
||||
}
|
||||
|
||||
expect() {
|
||||
_want=$1 _tool=$2 _label=$3
|
||||
_got=$(decision_for "$_tool")
|
||||
if [ "$_got" = "$_want" ]; then
|
||||
check() {
|
||||
_want=$1 _json=$2 _label=$3
|
||||
_got=$(run_guard "$_json")
|
||||
if [ "$_got" = "$_want rc=0" ]; then
|
||||
pass=$((pass + 1)); printf ' ok %s\n' "$_label"
|
||||
else
|
||||
fail=$((fail + 1)); printf ' FAIL %s\n want=%s got=%s tool=%s\n' "$_label" "$_want" "$_got" "$_tool"
|
||||
fail=$((fail + 1)); printf ' FAIL %s\n want=%s rc=0 got=%s\n in=%s\n' "$_label" "$_want" "$_got" "$_json"
|
||||
fi
|
||||
}
|
||||
tool() { printf '{"tool_name":"%s","tool_input":{"owner":"mathias","repo":"x"}}' "$1"; }
|
||||
|
||||
echo "mcp-destructive-guard tests"
|
||||
|
||||
# Irreversible verbs, on the plugin namespace.
|
||||
for v in repo_delete file_delete branch_delete pr_merge tbd_ship repo_update repo_mirror_push; do
|
||||
expect ask "mcp__plugin_skills_gitea__$v" "plugin gitea $v asks"
|
||||
for v in repo_delete file_delete branch_delete pr_merge tbd_ship repo_update repo_mirror_push \
|
||||
workflow_run_trigger tag_create release_create; do
|
||||
check ask "$(tool "mcp__plugin_skills_gitea__$v")" "plugin gitea $v asks"
|
||||
done
|
||||
|
||||
# The same verb reached through a different server name must not slip past:
|
||||
# the claude.ai connector, a bare local registration, or any future rename.
|
||||
expect ask "mcp__claude_ai_gitea__repo_delete" "connector namespace asks"
|
||||
expect ask "mcp__gitea__repo_delete" "bare server name asks"
|
||||
expect ask "mcp__git__repo_delete" "renamed server still asks"
|
||||
# The verb is matched on any server name: connector, bare, or renamed.
|
||||
check ask "$(tool mcp__claude_ai_gitea__repo_delete)" "connector namespace asks"
|
||||
check ask "$(tool mcp__gitea__repo_delete)" "bare server name asks"
|
||||
check ask "$(tool mcp__git__repo_delete)" "renamed server still asks"
|
||||
check ask "$(tool mcp__plugin_skills_gitea__REPO_DELETE)" "uppercase verb asks"
|
||||
# The verb is the LAST segment (gatekeeper: parsing the second segment stayed green).
|
||||
check ask "$(tool mcp__a__b__repo_delete)" "verb taken from last segment"
|
||||
check NONE "$(tool mcp__repo_delete__issue_get)" "server named like a verb does not trigger"
|
||||
|
||||
# Case variants must not bypass (tool names are matched exactly by the host,
|
||||
# but a guard that lowercases nothing should not depend on that).
|
||||
expect ask "mcp__plugin_skills_gitea__REPO_DELETE" "uppercase verb asks"
|
||||
# file_write_branch: content landing on main, or emptying a file, is the same
|
||||
# effect as the gated pr_merge / file_delete (gatekeeper).
|
||||
fwb() { printf '{"tool_name":"mcp__plugin_skills_gitea__file_write_branch","tool_input":{"branch":"%s","content":"%s"}}' "$1" "$2"; }
|
||||
check ask "$(fwb main x)" "file_write_branch to main asks"
|
||||
check ask "$(fwb master x)" "file_write_branch to master asks"
|
||||
check ask "$(fwb feat/y '')" "file_write_branch emptying a file asks"
|
||||
check ask '{"tool_name":"mcp__plugin_skills_gitea__file_write_branch","tool_input":{"content":"x"}}' "file_write_branch without branch asks"
|
||||
check NONE "$(fwb feat/y x)" "file_write_branch to a feature branch passes"
|
||||
|
||||
# Reversible / read verbs pass through untouched.
|
||||
for v in issue_close issue_create file_read repo_list pr_create file_write_branch; do
|
||||
expect NONE "mcp__plugin_skills_gitea__$v" "$v passes through"
|
||||
# Reversible / read verbs pass through.
|
||||
for v in issue_close issue_create file_read repo_list pr_create; do
|
||||
check NONE "$(tool "mcp__plugin_skills_gitea__$v")" "$v passes through"
|
||||
done
|
||||
check NONE "$(tool mcp__plugin_skills_gitea__repo_delete_dry_run_list)" "suffix near-miss passes"
|
||||
check NONE "$(tool Bash)" "non-MCP tool passes"
|
||||
check NONE "$(tool repo_delete)" "non-MCP tool named like a verb passes"
|
||||
|
||||
# Near-miss names are not the guarded verb.
|
||||
expect NONE "mcp__plugin_skills_gitea__repo_delete_dry_run_list" "suffix near-miss passes"
|
||||
expect NONE "Bash" "non-MCP tool passes"
|
||||
# Malformed input fails CLOSED (gatekeeper: non-string tool_name got NONE).
|
||||
check ask 'not json' "non-JSON asks"
|
||||
check ask '{}' "missing tool_name asks"
|
||||
check ask '{"tool_name":null}' "null tool_name asks"
|
||||
check ask '{"tool_name":""}' "empty tool_name asks"
|
||||
check ask '{"tool_name":5}' "number tool_name asks"
|
||||
check ask '{"tool_name":["mcp__x__repo_delete"]}' "array tool_name asks"
|
||||
check ask '{"tool_name":{"a":1}}' "object tool_name asks"
|
||||
|
||||
# Malformed input fails CLOSED (ask), never open.
|
||||
_got=$(printf 'not json' | "$GUARD" | decode)
|
||||
if [ "$_got" = "ask" ]; then pass=$((pass+1)); echo " ok malformed input asks"; else fail=$((fail+1)); echo " FAIL malformed input: got=$_got"; fi
|
||||
|
||||
# Executed as a program, like Claude Code does (shebang decides interpreter).
|
||||
[ -x "$GUARD" ] && { pass=$((pass+1)); echo " ok guard is executable"; } || { fail=$((fail+1)); echo " FAIL guard not executable"; }
|
||||
# Without jq on PATH the guard must still answer ask, not stay silent
|
||||
# (gatekeeper: the fail-closed path itself needed jq).
|
||||
nojq=$(mktemp -d); trap 'rm -rf "$nojq"' EXIT
|
||||
for b in bash cat grep tr sed; do ln -s "$(command -v $b)" "$nojq/$b"; done
|
||||
_got=$(run_guard "$(tool mcp__plugin_skills_gitea__repo_delete)" "$nojq")
|
||||
if [ "$_got" = "ask rc=0" ]; then pass=$((pass+1)); echo " ok no jq on PATH still asks"; else fail=$((fail+1)); echo " FAIL no jq on PATH: got=$_got"; fi
|
||||
_got=$(run_guard "$(tool mcp__plugin_skills_gitea__issue_get)" "$nojq")
|
||||
if [ "$_got" = "ask rc=0" ]; then pass=$((pass+1)); echo " ok no jq on PATH asks even for a read verb (cannot parse = cannot clear)"; else fail=$((fail+1)); echo " FAIL no jq read verb: got=$_got"; fi
|
||||
|
||||
printf '\n%d passed, %d failed\n' "$pass" "$fail"
|
||||
[ "$fail" -eq 0 ]
|
||||
|
||||
Reference in New Issue
Block a user