fix: execute bash perms for potential unwanted execution (#444)

Author: brandonskiser

crates/chat-cli/src/cli/chat/tools/execute/mod.rs

@@ -81,12 +81,20 @@ impl ExecuteCommand {
                 // against unwanted mutations
                 Some(cmd)
                     if cmd == "find"
-                        && cmd_args
-                            .iter()
-                            .any(|arg| arg.contains("-exec") || arg.contains("-delete")) =>
+                        && cmd_args.iter().any(|arg| {
+                            arg.contains("-exec") // includes -execdir
+                                || arg.contains("-delete")
+                                || arg.contains("-ok") // includes -okdir
+                        }) =>
                 {
                     return true;
                 },
+                // Special casing for `grep`. -P flag for perl regexp has RCE issues, apparently
+                // should not be supported within grep but is flagged as a possibility since this is perl
+                // regexp.
+                Some(cmd) if cmd == "grep" && cmd_args.iter().any(|arg| arg.contains("-P")) => {
+                    return true;
+                },
                 Some(cmd) if !READONLY_COMMANDS.contains(&cmd.as_str()) => return true,
                 None => return true,
                 _ => (),
@@ -162,6 +170,66 @@ pub fn format_output(output: &str, max_size: usize) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn test_requires_acceptance_for_readonly_commands() {
+        let cmds = &[
+            // Safe commands
+            ("ls ~", false),
+            ("ls -al ~", false),
+            ("pwd", false),
+            ("echo 'Hello, world!'", false),
+            ("which aws", false),
+            // Potentially dangerous readonly commands
+            ("echo hi > myimportantfile", true),
+            ("ls -al >myimportantfile", true),
+            ("echo hi 2> myimportantfile", true),
+            ("echo hi >> myimportantfile", true),
+            ("echo $(rm myimportantfile)", true),
+            ("echo `rm myimportantfile`", true),
+            ("echo hello && rm myimportantfile", true),
+            ("echo hello&&rm myimportantfile", true),
+            ("ls nonexistantpath || rm myimportantfile", true),
+            ("echo myimportantfile | xargs rm", true),
+            ("echo myimportantfile|args rm", true),
+            ("echo <(rm myimportantfile)", true),
+            ("cat <<< 'some string here' > myimportantfile", true),
+            ("echo '\n#!/usr/bin/env bash\necho hello\n' > myscript.sh", true),
+            ("cat <<EOF > myimportantfile\nhello world\nEOF", true),
+            // Safe piped commands
+            ("find . -name '*.rs' | grep main", false),
+            ("ls -la | grep .git", false),
+            ("cat file.txt | grep pattern | head -n 5", false),
+            // Unsafe piped commands
+            ("find . -name '*.rs' | rm", true),
+            ("ls -la | grep .git | rm -rf", true),
+            ("echo hello | sudo rm -rf /", true),
+            // `find` command arguments
+            ("find important-dir/ -exec rm {} \\;", true),
+            ("find . -name '*.c' -execdir gcc -o '{}.out' '{}' \\;", true),
+            ("find important-dir/ -delete", true),
+            (
+                "echo y | find . -type f -maxdepth 1 -okdir open -a Calculator {} +",
+                true,
+            ),
+            ("find important-dir/ -name '*.txt'", false),
+            // `grep` command arguments
+            ("echo 'test data' | grep -P '(?{system(\"date\")})'", true),
+        ];
+        for (cmd, expected) in cmds {
+            let tool = serde_json::from_value::<ExecuteCommand>(serde_json::json!({
+                "command": cmd,
+            }))
+            .unwrap();
+            assert_eq!(
+                tool.requires_acceptance(),
+                *expected,
+                "expected command: `{}` to have requires_acceptance: `{}`",
+                cmd,
+                expected
+            );
+        }
+    }
+
     #[test]
     fn test_requires_acceptance_for_windows_commands() {
         let cmds = &[