Added: Detect any folder deletion (rmdir) command. (#129)

kaplanelad · Aug 9, 2023 · da4c5b2 · da4c5b2
1 parent 931d41b
commit da4c5b2
Show file tree

Hide file tree

Showing 6 changed files with 48 additions and 3 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/docs/checks/fs-strict.md b/docs/checks/fs-strict.md
@@ -2,7 +2,9 @@
 
 :warning: make sure that `fs` group also enabled :warning: 
 
-* Detect any deletion (`rm`) command.  
+* Detect any deletion (`rm`) command.
+
+* Detect any folder deletion (`rmdir`) command.  
 
 * Detect and permissions changes (`chmod`) command.
 

diff --git a/shellfirm/Cargo.toml b/shellfirm/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "shellfirm"
 description = "`shellfirm` will intercept any risky patterns (default or defined by you) and prompt you a small challenge for double verification, kinda like a captcha for your terminal."
-version = "0.2.7"
+version = "0.2.8"
 edition = "2021"
 authors = ["Elad-Kaplan <kaplan.elad@gmail.com>"]
 license = "MIT"

diff --git a/shellfirm/checks/fs-strict.yaml b/shellfirm/checks/fs-strict.yaml
@@ -6,5 +6,11 @@
   test: rm\s{1,}(?:-rf|-fr|-r|-f)?\s*(.*)
   description: "Are you sure you want to continue with deletion?"
   id: fs-strict:any_deletion
+  filters:
+    IsExists: "1"
+- from: fs-strict
+  test: rmdir\s
+  description: "Are you sure you want to continue with deletion?"
+  id: fs-strict:folder_deletion
   filters:
     IsExists: "1"
diff --git a/shellfirm/tests/checks/fs-strict-folder_deletion.yaml b/shellfirm/tests/checks/fs-strict-folder_deletion.yaml
@@ -0,0 +1,7 @@
+---
+- test: rmdir TestFolder
+  description: match command by finding existing file
+- test: rmdir -pv TestFolder
+  description: match command with flags
+- test: rmdir    -pv    TestFolder
+  description: match command with spaces
diff --git a/shellfirm/tests/snapshots/checks__fs-strict-folder_deletion.yaml.snap b/shellfirm/tests/snapshots/checks__fs-strict-folder_deletion.yaml.snap
@@ -0,0 +1,30 @@
+---
+source: shellfirm/tests/checks.rs
+expression: test_file_results
+---
+[
+    TestSensitivePatternsResult {
+        file_path: "fs-strict-folder_deletion.yaml",
+        test: "rmdir TestFolder",
+        check_detection_ids: [
+            "fs-strict:folder_deletion",
+        ],
+        test_description: "match command by finding existing file",
+    },
+    TestSensitivePatternsResult {
+        file_path: "fs-strict-folder_deletion.yaml",
+        test: "rmdir -pv TestFolder",
+        check_detection_ids: [
+            "fs-strict:folder_deletion",
+        ],
+        test_description: "match command with flags",
+    },
+    TestSensitivePatternsResult {
+        file_path: "fs-strict-folder_deletion.yaml",
+        test: "rmdir    -pv    TestFolder",
+        check_detection_ids: [
+            "fs-strict:folder_deletion",
+        ],
+        test_description: "match command with spaces",
+    },
+]