cmdguard

Documentation

Index

• Variables
• func Command(name string, arg ...string) (cmd *exec.Cmd, err error)
• func ShellCommand(name string, arg ...string) (cmd *exec.Cmd, err error)
• func ValidateCommandSlice(commandSlice []string) (err error)
• func ValidateShellCommandSlice(shellCommandSlice []string) (err error)
• type CommandValidater

Variables

var AllowedShellCommands = map[string]CommandValidater{
	"bash -c": ExactMatch,
	"sh -c":   ExactMatch,
}

Make sure the shell command is allowed

Functions

func Command

func Command(name string, arg ...string) (cmd *exec.Cmd, err error)

Command checks the args before creating *exec.Cmd

func ShellCommand

func ShellCommand(name string, arg ...string) (cmd *exec.Cmd, err error)

ShellCommand is a safe wrapper of exec.Command that checks potential risks in the command. It requires the command follows the format like ["bash", "-c", "<shell script>"] and each part of the command must be valid. If no shell command is needed, use security.Command instead.

func ValidateCommandSlice

func ValidateCommandSlice(commandSlice []string) (err error)

ValidateCommandSlice validates all the commands in the commandSlice. - For command in allowedPathList, it passes validation without further checks. - For a possible shell command, it calls ValidateShellCommandSlice() for detailed checks. - For any other command, it checks all the command args to ensure no illegal chars exists.

func ValidateShellCommandSlice

func ValidateShellCommandSlice(shellCommandSlice []string) (err error)

ValidateShellCommandSlice takes in a slice of shell commands and returns an error if any are invalid. The function looks specifically for pipe commands (i.e., commands that contain a '|'). If a pipe command is found in the slice, ValidatePipeCommandSlice is called for further validation.

Types

type CommandValidater

type CommandValidater func(str string, pattern string) bool

var (
	PrefixMatch CommandValidater = func(str, pattern string) bool { return strings.HasPrefix(str, pattern) }
	ExactMatch  CommandValidater = func(str, pattern string) bool { return str == pattern }
)