mirror of
https://github.com/rtk-ai/rtk.git
synced 2026-09-19 07:33:17 +08:00
Florian BRUNIAUX
7c15664ed4
Add 4 new HARD FAIL patterns and 3 new WARN patterns to check-security-patterns.sh.
All new patterns have zero existing occurrences in the codebase (verified).
HARD FAIL additions:
- LD_PRELOAD / LD_LIBRARY_PATH env injection (linker hijack)
- TcpStream::connect / UdpSocket::bind / TcpListener::bind (raw sockets)
- reqwest:: (HTTP client — would also break <10ms startup via async runtime)
- Command::new("curl"|"wget"|"python3?"|"node"|"perl"|"ruby"|"powershell"|"pwsh")
(download/interpreter tools — legitimate RTK code uses resolved_command() instead)
WARN additions:
- remove_file / remove_dir_all (expected in hooks, surprising in filter code)
- References to sensitive paths (/.ssh/, /etc/, .bashrc, authorized_keys)
- .env("PATH") manipulation
--self-test now covers all 6 HARD FAIL patterns (was 2).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Florian BRUNIAUX <florian@bruniaux.com>