Claude hooks auto-backup: manual (backup_20250720_091250)
This commit is contained in:
parent
9445e09c48
commit
392833187e
135 changed files with 16151 additions and 3439 deletions
|
|
@ -8,31 +8,31 @@ If you have commands that should never be run in your environment:
|
|||
|
||||
1. **Edit the command validator**:
|
||||
```bash
|
||||
nano hooks/command_validator.py
|
||||
nano hooks/command-validator.js
|
||||
```
|
||||
|
||||
2. **Find the dangerous_patterns list** (around line 23):
|
||||
```python
|
||||
self.dangerous_patterns = [
|
||||
r'rm\s+-rf\s+/', # Delete root
|
||||
r'mkfs\.', # Format filesystem
|
||||
# Add your pattern here
|
||||
]
|
||||
2. **Find the dangerousPatterns array** (around line 23):
|
||||
```javascript
|
||||
this.dangerousPatterns = [
|
||||
/rm\s+-rf\s+\//, // Delete root
|
||||
/mkfs\./, // Format filesystem
|
||||
// Add your pattern here
|
||||
];
|
||||
```
|
||||
|
||||
3. **Add your pattern**:
|
||||
```python
|
||||
self.dangerous_patterns = [
|
||||
r'rm\s+-rf\s+/', # Delete root
|
||||
r'mkfs\.', # Format filesystem
|
||||
r'docker\s+system\s+prune\s+--all', # Delete all Docker data
|
||||
r'kubectl\s+delete\s+namespace\s+production', # Delete prod namespace
|
||||
]
|
||||
```javascript
|
||||
this.dangerousPatterns = [
|
||||
/rm\s+-rf\s+\//, // Delete root
|
||||
/mkfs\./, // Format filesystem
|
||||
/docker\s+system\s+prune\s+--all/, // Delete all Docker data
|
||||
/kubectl\s+delete\s+namespace\s+production/, // Delete prod namespace
|
||||
];
|
||||
```
|
||||
|
||||
4. **Test your pattern**:
|
||||
```bash
|
||||
echo '{"tool": "Bash", "parameters": {"command": "docker system prune --all"}}' | python3 hooks/command_validator.py
|
||||
echo '{"tool": "Bash", "parameters": {"command": "docker system prune --all"}}' | node hooks/command-validator.js
|
||||
```
|
||||
|
||||
Should return: `{"allow": false, "message": "⛔ Command blocked: Dangerous command pattern detected"}`
|
||||
|
|
@ -41,23 +41,23 @@ If you have commands that should never be run in your environment:
|
|||
|
||||
For commands that are risky but sometimes legitimate:
|
||||
|
||||
1. **Find the suspicious_patterns list**:
|
||||
```python
|
||||
self.suspicious_patterns = [
|
||||
r'sudo\s+rm', # Sudo with rm
|
||||
r'chmod\s+777', # Overly permissive
|
||||
# Add your pattern here
|
||||
]
|
||||
1. **Find the suspiciousPatterns array**:
|
||||
```javascript
|
||||
this.suspiciousPatterns = [
|
||||
/sudo\s+rm/, // Sudo with rm
|
||||
/chmod\s+777/, // Overly permissive
|
||||
// Add your pattern here
|
||||
];
|
||||
```
|
||||
|
||||
2. **Add patterns that should warn but not block**:
|
||||
```python
|
||||
self.suspicious_patterns = [
|
||||
r'sudo\s+rm', # Sudo with rm
|
||||
r'chmod\s+777', # Overly permissive
|
||||
r'npm\s+install\s+.*--global', # Global npm installs
|
||||
r'pip\s+install.*--user', # User pip installs
|
||||
]
|
||||
```javascript
|
||||
this.suspiciousPatterns = [
|
||||
/sudo\s+rm/, // Sudo with rm
|
||||
/chmod\s+777/, // Overly permissive
|
||||
/npm\s+install\s+.*--global/, // Global npm installs
|
||||
/pip\s+install.*--user/, // User pip installs
|
||||
];
|
||||
```
|
||||
|
||||
## Customize for Your Tech Stack
|
||||
|
|
@ -65,66 +65,66 @@ For commands that are risky but sometimes legitimate:
|
|||
### For Docker Environments
|
||||
|
||||
Add Docker-specific protections:
|
||||
```python
|
||||
# In dangerous_patterns:
|
||||
r'docker\s+rm\s+.*-f.*', # Force remove containers
|
||||
r'docker\s+rmi\s+.*-f.*', # Force remove images
|
||||
```javascript
|
||||
// In dangerousPatterns:
|
||||
/docker\s+rm\s+.*-f.*/, // Force remove containers
|
||||
/docker\s+rmi\s+.*-f.*/, // Force remove images
|
||||
|
||||
# In suspicious_patterns:
|
||||
r'docker\s+run.*--privileged', # Privileged containers
|
||||
r'docker.*-v\s+/:/.*', # Mount root filesystem
|
||||
// In suspiciousPatterns:
|
||||
/docker\s+run.*--privileged/, // Privileged containers
|
||||
/docker.*-v\s+\/:\/.*/, // Mount root filesystem
|
||||
```
|
||||
|
||||
### For Kubernetes
|
||||
|
||||
Protect production namespaces:
|
||||
```python
|
||||
# In dangerous_patterns:
|
||||
r'kubectl\s+delete\s+.*production.*',
|
||||
r'kubectl\s+delete\s+.*prod.*',
|
||||
r'helm\s+delete\s+.*production.*',
|
||||
```javascript
|
||||
// In dangerousPatterns:
|
||||
/kubectl\s+delete\s+.*production.*/,
|
||||
/kubectl\s+delete\s+.*prod.*/,
|
||||
/helm\s+delete\s+.*production.*/,
|
||||
|
||||
# In suspicious_patterns:
|
||||
r'kubectl\s+apply.*production.*',
|
||||
r'kubectl.*--all-namespaces.*delete',
|
||||
// In suspiciousPatterns:
|
||||
/kubectl\s+apply.*production.*/,
|
||||
/kubectl.*--all-namespaces.*delete/,
|
||||
```
|
||||
|
||||
### For Database Operations
|
||||
|
||||
Prevent destructive database commands:
|
||||
```python
|
||||
# In dangerous_patterns:
|
||||
r'DROP\s+DATABASE.*',
|
||||
r'TRUNCATE\s+TABLE.*',
|
||||
r'DELETE\s+FROM.*WHERE\s+1=1',
|
||||
```javascript
|
||||
// In dangerousPatterns:
|
||||
/DROP\s+DATABASE.*/i,
|
||||
/TRUNCATE\s+TABLE.*/i,
|
||||
/DELETE\s+FROM.*WHERE\s+1=1/i,
|
||||
|
||||
# In suspicious_patterns:
|
||||
r'UPDATE.*SET.*WHERE\s+1=1',
|
||||
r'ALTER\s+TABLE.*DROP.*',
|
||||
// In suspiciousPatterns:
|
||||
/UPDATE.*SET.*WHERE\s+1=1/i,
|
||||
/ALTER\s+TABLE.*DROP.*/i,
|
||||
```
|
||||
|
||||
## Environment-Specific Patterns
|
||||
|
||||
### For Production Servers
|
||||
|
||||
```python
|
||||
# In dangerous_patterns:
|
||||
r'systemctl\s+stop\s+(nginx|apache|mysql)',
|
||||
r'service\s+(nginx|apache|mysql)\s+stop',
|
||||
r'killall\s+-9.*',
|
||||
```javascript
|
||||
// In dangerousPatterns:
|
||||
/systemctl\s+stop\s+(nginx|apache|mysql)/,
|
||||
/service\s+(nginx|apache|mysql)\s+stop/,
|
||||
/killall\s+-9.*/,
|
||||
|
||||
# In suspicious_patterns:
|
||||
r'sudo\s+systemctl\s+restart.*',
|
||||
r'sudo\s+service.*restart.*',
|
||||
// In suspiciousPatterns:
|
||||
/sudo\s+systemctl\s+restart.*/,
|
||||
/sudo\s+service.*restart.*/,
|
||||
```
|
||||
|
||||
### For Development Machines
|
||||
|
||||
```python
|
||||
# In suspicious_patterns:
|
||||
r'rm\s+-rf\s+node_modules', # Can break local dev
|
||||
r'git\s+reset\s+--hard\s+HEAD~[0-9]+', # Lose multiple commits
|
||||
r'git\s+push\s+.*--force.*', # Force push
|
||||
```javascript
|
||||
// In suspiciousPatterns:
|
||||
/rm\s+-rf\s+node_modules/, // Can break local dev
|
||||
/git\s+reset\s+--hard\s+HEAD~[0-9]+/, // Lose multiple commits
|
||||
/git\s+push\s+.*--force.*/, // Force push
|
||||
```
|
||||
|
||||
## Test Your Custom Patterns
|
||||
|
|
@ -137,15 +137,15 @@ cat > test_patterns.sh << 'EOF'
|
|||
|
||||
# Test dangerous pattern (should block)
|
||||
echo "Testing dangerous pattern..."
|
||||
echo '{"tool": "Bash", "parameters": {"command": "docker system prune --all"}}' | python3 hooks/command_validator.py
|
||||
echo '{"tool": "Bash", "parameters": {"command": "docker system prune --all"}}' | node hooks/command-validator.js
|
||||
|
||||
# Test suspicious pattern (should warn)
|
||||
echo "Testing suspicious pattern..."
|
||||
echo '{"tool": "Bash", "parameters": {"command": "npm install -g dangerous-package"}}' | python3 hooks/command_validator.py
|
||||
echo '{"tool": "Bash", "parameters": {"command": "npm install -g dangerous-package"}}' | node hooks/command-validator.js
|
||||
|
||||
# Test normal command (should pass)
|
||||
echo "Testing normal command..."
|
||||
echo '{"tool": "Bash", "parameters": {"command": "ls -la"}}' | python3 hooks/command_validator.py
|
||||
echo '{"tool": "Bash", "parameters": {"command": "ls -la"}}' | node hooks/command-validator.js
|
||||
EOF
|
||||
|
||||
chmod +x test_patterns.sh
|
||||
|
|
@ -157,29 +157,34 @@ chmod +x test_patterns.sh
|
|||
For patterns that depend on file context:
|
||||
|
||||
1. **Edit the validation function** to check current directory or files:
|
||||
```python
|
||||
def validate_command_safety(self, command: str) -> ValidationResult:
|
||||
# Your existing patterns...
|
||||
```javascript
|
||||
validateCommandSafety(command) {
|
||||
// Your existing patterns...
|
||||
|
||||
# Context-aware validation
|
||||
if "git push" in command.lower():
|
||||
# Check if we're in a production branch
|
||||
try:
|
||||
current_branch = subprocess.check_output(['git', 'branch', '--show-current'],
|
||||
text=True).strip()
|
||||
if current_branch in ['main', 'master', 'production']:
|
||||
return ValidationResult(
|
||||
allowed=True,
|
||||
reason="⚠️ Pushing to protected branch",
|
||||
severity="warning"
|
||||
)
|
||||
except:
|
||||
pass
|
||||
// Context-aware validation
|
||||
if (command.toLowerCase().includes("git push")) {
|
||||
// Check if we're in a production branch
|
||||
try {
|
||||
const { execSync } = require('child_process');
|
||||
const currentBranch = execSync('git branch --show-current',
|
||||
{ encoding: 'utf8' }).trim();
|
||||
if (['main', 'master', 'production'].includes(currentBranch)) {
|
||||
return {
|
||||
allowed: true,
|
||||
reason: "⚠️ Pushing to protected branch",
|
||||
severity: "warning"
|
||||
};
|
||||
}
|
||||
} catch {
|
||||
// Ignore errors
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Pattern Syntax Reference
|
||||
|
||||
Use Python regex patterns:
|
||||
Use JavaScript regex patterns:
|
||||
|
||||
- `\s+` - One or more whitespace characters
|
||||
- `.*` - Any characters (greedy)
|
||||
|
|
@ -188,11 +193,12 @@ Use Python regex patterns:
|
|||
- `(option1|option2)` - Either option1 or option2
|
||||
- `^` - Start of string
|
||||
- `$` - End of string
|
||||
- `i` flag - Case insensitive matching
|
||||
|
||||
**Examples**:
|
||||
- `r'rm\s+-rf\s+/'` - Matches "rm -rf /"
|
||||
- `r'git\s+push.*--force'` - Matches "git push" followed by "--force" anywhere
|
||||
- `r'^sudo\s+'` - Matches commands starting with "sudo"
|
||||
- `/rm\s+-rf\s+\//` - Matches "rm -rf /"
|
||||
- `/git\s+push.*--force/` - Matches "git push" followed by "--force" anywhere
|
||||
- `/^sudo\s+/` - Matches commands starting with "sudo"
|
||||
|
||||
## Reload Changes
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue