security

package

v0.1.16 Latest Latest Go to latest Published: Jun 26, 2026 License: Apache-2.0 Imports: 6 Imported by: 0

Details

This section is empty.

This section is empty.

func GetSafeWriteRoot() string

GetSafeWriteRoot 获取安全写入根目录，优先使用配置值，其次使用环境变量

func IsWriteDenied(path string) error

IsWriteDenied 检查路径是否被拒绝写入（黑名单检查）

func NearestExistingAncestor(path string) (string, error)

NearestExistingAncestor 查找路径最近的已存在的祖先目录

func PathWithinWorkspace(path string) error

PathWithinWorkspace 检查路径是否在工作区内

func RealWorkspaceRoot() (string, error)

RealWorkspaceRoot 获取工作区根目录的真实路径（解析符号链接）。

func ResolveExistingWorkspacePath(path string) (string, error)

ResolveExistingWorkspacePath 解析路径并验证符号链接目标在工作区内

func ResolveWorkspacePath(path string) (string, error)

ResolveWorkspacePath 解析相对于工作区的路径，检查是否超出工作区

func SanitizedEnv(extra map[string]string) []string

SanitizedEnv 净化环境变量，移除敏感凭证

func SetWriteSafeRoot(root string)

SetWriteSafeRoot 设置安全写入根目录

func ValidateWritableWorkspacePath(path string) error

ValidateWritableWorkspacePath 验证路径可用于写入，检查符号链接和父目录

func WorkspaceRoot() (string, error)

WorkspaceRoot 获取工作区根目录。

type ApprovalResult struct {
	Approved    bool
	Status      string
	PatternKey  string
	Description string
	Message     string
}

ApprovalResult 命令审批结果

func CheckDangerousCommand(command string) ApprovalResult

CheckDangerousCommand 检查命令是否危险

type DangerousPattern struct {
	Regex    *regexp.Regexp
	Name     string
	Severity string
}

DangerousPattern 危险命令模式