admin/trailofbits-claude-code-config
1
0
Fork 0
mirror of https://github.com/trailofbits/claude-code-config synced 2026-06-21 14:11:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Simplify: keep hook regex, drop redundant deny rule permutations

Browse Source 
The rewritten hook regex already handles all case/ordering variants of
rm flags via case-insensitive chained grep checks. Remove the 16
enumerated permutations from deny rules. Drop overly broad * | sh and
* | zsh rules that would block legitimate pipes. Revert unnecessary
case-insensitive flag on git push hook (git is always lowercase).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Dan Guido
2026-02-23 15:23:33 -08:00
parent 58b6f73e2a
commit 33815281ec
1 changed files with 1 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
settings.json
+1 -20
View File
@@ -13,23 +13,6 @@
"deny": [
"Bash(rm -rf *)",
"Bash(rm -fr *)",
"Bash(rm -Rf *)",
"Bash(rm -rF *)",
"Bash(rm -RF *)",
"Bash(rm -fR *)",
"Bash(rm -Fr *)",
"Bash(rm -FR *)",
"Bash(rm -r -f *)",
"Bash(rm -r -F *)",
"Bash(rm -R -f *)",
"Bash(rm -R -F *)",
"Bash(rm -f -r *)",
"Bash(rm -f -R *)",
"Bash(rm -F -r *)",
"Bash(rm -F -R *)",
"Bash(rm --recursive *)",
"Bash(rm --recursive --force *)",
"Bash(rm --force --recursive *)",
"Bash(sudo *)",
"Bash(mkfs *)",
"Bash(dd *)",
@@ -37,8 +20,6 @@
"Bash(curl *| bash*)",
"Bash(wget *|bash*)",
"Bash(wget *| bash*)",
"Bash(* | sh)",
"Bash(* | zsh)",
"Bash(bash <(curl *))",
"Bash(git push --force*)",
"Bash(git push *--force*)",
@@ -79,7 +60,7 @@
},
{
"type": "command",
"command": "CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qiE 'git[[:space:]]+push.*(main|master)'; then echo 'BLOCKED: Use feature branches, not direct push to main' >&2; exit 2; fi"
"command": "CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qE 'git[[:space:]]+push.*(main|master)'; then echo 'BLOCKED: Use feature branches, not direct push to main' >&2; exit 2; fi"
}
]
}