2 Commits

Author	SHA1	Message	Date
Florian BRUNIAUX	7c15664ed4	ci(security): extend pattern checks — injection, network, interpreters ... Add 4 new HARD FAIL patterns and 3 new WARN patterns to check-security-patterns.sh. All new patterns have zero existing occurrences in the codebase (verified). HARD FAIL additions: - LD_PRELOAD / LD_LIBRARY_PATH env injection (linker hijack) - TcpStream::connect / UdpSocket::bind / TcpListener::bind (raw sockets) - reqwest:: (HTTP client — would also break <10ms startup via async runtime) - Command::new("curl"|"wget"|"python3?"|"node"|"perl"|"ruby"|"powershell"|"pwsh") (download/interpreter tools — legitimate RTK code uses resolved_command() instead) WARN additions: - remove_file / remove_dir_all (expected in hooks, surprising in filter code) - References to sensitive paths (/.ssh/, /etc/, .bashrc, authorized_keys) - .env("PATH") manipulation --self-test now covers all 6 HARD FAIL patterns (was 2). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Florian BRUNIAUX <florian@bruniaux.com>	2026-03-31 14:30:39 +02:00
Florian BRUNIAUX	e57967ddc6	ci: enforce security patterns on new code ... Add check-security-patterns.sh + CI job that hard-fails if any PR introduces new shell execution (Command::new("sh"/"bash"/"cmd")) or unsafe {} blocks in Rust source. Scans only added lines via `git diff --unified=0 --diff-filter=AM` + `grep '^+'` — never flags pre-existing code (e.g. runner.rs issue #640). Also adds `-D unsafe_code` to the clippy job: RTK currently has zero unsafe blocks, so this is free to enforce now. Warn-only (non-blocking) for new .unwrap() and println! in filter code. --self-test mode available for local verification. Closes no issue — terrain vierge (verified: no prior PR/issue for this). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Florian BRUNIAUX <florian@bruniaux.com>	2026-03-31 14:04:14 +02:00