admin/trailofbits-claude-code-config
1
0
Fork 0
mirror of https://github.com/trailofbits/claude-code-config synced 2026-06-21 14:11:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #33 from NucleiAv/main

Browse Source 
fix: expand deny rules and harden hook regex for rm & pipe-to-shell bypasses
This commit is contained in:
Dan Guido
2026-02-23 15:35:11 -08:00
committed by GitHub
parent df8374dd00 e6ebafacae
commit dbcc656b90
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
settings.json
+2 -2
View File
@@ -16,8 +16,8 @@
"Bash(sudo *)",
"Bash(mkfs *)",
"Bash(dd *)",
"Bash(curl *|bash*)",
"Bash(wget *|bash*)",
"Bash(wget *| bash*)",
"Bash(git push --force*)",
"Bash(git push *--force*)",
"Bash(git reset --hard*)",
@@ -53,7 +53,7 @@
"hooks": [
{
"type": "command",
"command": "CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qE 'rm[[:space:]]+-[^[:space:]]*r[^[:space:]]*f'; then echo 'BLOCKED: Use trash instead of rm -rf' >&2; exit 2; fi"
"command": "CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qiE '(^|;[[:space:]]*|&&[[:space:]]*|[|][|][[:space:]]*|[|][[:space:]]*)rm[[:space:]]' && echo \"$CMD\" | grep -qiE '(^|[[:space:]])-[a-zA-Z]*[rR]|--recursive' && echo \"$CMD\" | grep -qiE '(^|[[:space:]])-[a-zA-Z]*[fF]|--force'; then echo 'BLOCKED: Use trash instead of rm -rf' >&2; exit 2; fi"
},
{
"type": "command",