Skip to content

fix(chat): change warning category and show the currect warning message #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 4 commits into from
Closed

fix(chat): change warning category and show the currect warning message #30

Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
945a882
change warning category and default present logic for uncategory command
Randall-Jiang Apr 8, 2025
a84097b
remove the highrisk message
Randall-Jiang Apr 8, 2025
b559e6c
fix the default show message for dangerous pattern
Randall-Jiang Apr 8, 2025
3a54e8a
remove the dangerous pattern check (appsec verified)
Randall-Jiang Apr 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
91 changes: 38 additions & 53 deletions packages/core/src/codewhispererChat/tools/executeBash.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ import { split } from 'shlex'

export enum CommandCategory {
ReadOnly,
HighRisk,
Mutate,
Destructive,
}

Expand Down Expand Up @@ -47,45 +47,37 @@ export const commandCategories = new Map<string, CommandCategory>([
['netstat', CommandCategory.ReadOnly],
['ss', CommandCategory.ReadOnly],
['dig', CommandCategory.ReadOnly],
['grep', CommandCategory.ReadOnly],
['wc', CommandCategory.ReadOnly],
['sort', CommandCategory.ReadOnly],
['diff', CommandCategory.ReadOnly],
['head', CommandCategory.ReadOnly],
['tail', CommandCategory.ReadOnly],

// HighRisk commands
['chmod', CommandCategory.HighRisk],
['chown', CommandCategory.HighRisk],
['mv', CommandCategory.HighRisk],
['cp', CommandCategory.HighRisk],
['ln', CommandCategory.HighRisk],
['mount', CommandCategory.HighRisk],
['umount', CommandCategory.HighRisk],
['kill', CommandCategory.HighRisk],
['killall', CommandCategory.HighRisk],
['pkill', CommandCategory.HighRisk],
['iptables', CommandCategory.HighRisk],
['route', CommandCategory.HighRisk],
['systemctl', CommandCategory.HighRisk],
['service', CommandCategory.HighRisk],
['crontab', CommandCategory.HighRisk],
['at', CommandCategory.HighRisk],
['tar', CommandCategory.HighRisk],
['awk', CommandCategory.HighRisk],
['sed', CommandCategory.HighRisk],
['wget', CommandCategory.HighRisk],
['curl', CommandCategory.HighRisk],
['nc', CommandCategory.HighRisk],
['ssh', CommandCategory.HighRisk],
['scp', CommandCategory.HighRisk],
['ftp', CommandCategory.HighRisk],
['sftp', CommandCategory.HighRisk],
['rsync', CommandCategory.HighRisk],
['chroot', CommandCategory.HighRisk],
['lsof', CommandCategory.HighRisk],
['strace', CommandCategory.HighRisk],
['gdb', CommandCategory.HighRisk],
// Mutable commands
['chmod', CommandCategory.Mutate],
['curl', CommandCategory.Mutate],
['mount', CommandCategory.Mutate],
['umount', CommandCategory.Mutate],
['systemctl', CommandCategory.Mutate],
['service', CommandCategory.Mutate],
['crontab', CommandCategory.Mutate],
['at', CommandCategory.Mutate],
['nc', CommandCategory.Mutate],
['ssh', CommandCategory.Mutate],
['scp', CommandCategory.Mutate],
['ftp', CommandCategory.Mutate],
['sftp', CommandCategory.Mutate],
['rsync', CommandCategory.Mutate],
['chroot', CommandCategory.Mutate],
['strace', CommandCategory.Mutate],
['gdb', CommandCategory.Mutate],
['apt', CommandCategory.Mutate],
['yum', CommandCategory.Mutate],
['dnf', CommandCategory.Mutate],
['pacman', CommandCategory.Mutate],
['exec', CommandCategory.Mutate],
['eval', CommandCategory.Mutate],
['xargs', CommandCategory.Mutate],

// Destructive commands
['rm', CommandCategory.Destructive],
Expand All @@ -104,22 +96,17 @@ export const commandCategories = new Map<string, CommandCategory>([
['insmod', CommandCategory.Destructive],
['rmmod', CommandCategory.Destructive],
['modprobe', CommandCategory.Destructive],
['apt', CommandCategory.Destructive],
['yum', CommandCategory.Destructive],
['dnf', CommandCategory.Destructive],
['pacman', CommandCategory.Destructive],
['perl', CommandCategory.Destructive],
['python', CommandCategory.Destructive],
['bash', CommandCategory.Destructive],
['sh', CommandCategory.Destructive],
['exec', CommandCategory.Destructive],
['eval', CommandCategory.Destructive],
['xargs', CommandCategory.Destructive],
['kill', CommandCategory.Destructive],
['killall', CommandCategory.Destructive],
['pkill', CommandCategory.Destructive],
['iptables', CommandCategory.Destructive],
['route', CommandCategory.Destructive],
['chown', CommandCategory.Destructive],
])
export const maxBashToolResponseSize: number = 1024 * 1024 // 1MB
export const lineCount: number = 1024
export const destructiveCommandWarningMessage = '⚠️ WARNING: Destructive command detected:\n\n'
export const highRiskCommandWarningMessage = '⚠️ WARNING: High risk command detected:\n\n'
export const mutateCommandWarningMessage = 'Mutation command:\n\n'

export interface ExecuteBashParams {
command: string
Expand Down Expand Up @@ -197,22 +184,20 @@ export class ExecuteBash {
switch (category) {
case CommandCategory.Destructive:
return { requiresAcceptance: true, warning: destructiveCommandWarningMessage }
case CommandCategory.HighRisk:
return {
requiresAcceptance: true,
warning: highRiskCommandWarningMessage,
}
case CommandCategory.Mutate:
return { requiresAcceptance: true, warning: mutateCommandWarningMessage }
case CommandCategory.ReadOnly:
if (
cmdArgs.some((arg) =>
Array.from(dangerousPatterns).some((pattern) => arg.includes(pattern))
)
) {
return { requiresAcceptance: true, warning: highRiskCommandWarningMessage }
// put the mutation message for dangerous pattern command for now, will update as long as finalized with appsec team
return { requiresAcceptance: true, warning: mutateCommandWarningMessage }
}
continue
default:
return { requiresAcceptance: true, warning: highRiskCommandWarningMessage }
return { requiresAcceptance: true }
}
}
return { requiresAcceptance: false }
Expand Down
Loading