babbarc/workspaces-pipelines
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add validation for commands with arbitrary arguments

Browse Source
This commit is contained in:
null 2025-05-17 16:58:07 +00:00
parent cfc10e0acd
commit d83040478e
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
validate_command_access.sh
View File

@ -7,19 +7,18 @@ validate_command() {
local tokens=("$@") local tokens=("$@")
local yaml="access.yml" local yaml="access.yml"
# Check if fixedArgsCommands.<cmd> exists # Check for fixed, multi, or arbitrary args commands
local is_fixed local is_fixed is_multi is_arbit
is_fixed="$(yq e ".\"$PERSON\".fixedArgsCommands | has(\"$cmd\")" "$yaml")" is_fixed="$(yq e ".\"$PERSON\".fixedArgsCommands | has(\"$cmd\")" "$yaml")"
# Check if multiArgsCommands.<cmd> exists
local is_multi
is_multi="$(yq e ".\"$PERSON\".multiArgsCommands | has(\"$cmd\")" "$yaml")" is_multi="$(yq e ".\"$PERSON\".multiArgsCommands | has(\"$cmd\")" "$yaml")"
is_arbit="$(yq e ".\"$PERSON\".arbitArgsCommands[]" "$yaml" | grep -qx "$cmd" && echo true || echo false)"
if [[ "$is_fixed" != "true" && "$is_multi" != "true" ]]; then if [[ "$is_fixed" != "true" && "$is_multi" != "true" && "$is_arbit" != "true" ]]; then
echo "ERROR: Command '$cmd' not allowed for $PERSON" >&2 echo "ERROR: Command '$cmd' not allowed for $PERSON" >&2
return 1 return 1
fi fi
# Exclude flags from positional args # Exclude flags from positional args for fixed/multi; pass all for arbit
local args=() local args=()
for tok in "${tokens[@]}"; do for tok in "${tokens[@]}"; do
[[ "$tok" == -* ]] && continue [[ "$tok" == -* ]] && continue
@ -80,4 +79,9 @@ validate_command() {
done done
return 0 return 0
fi fi
if [[ "$is_arbit" == "true" ]]; then
# Arbitrary arguments allowed, always valid
return 0
fi
} }